--- title: "Backup & Disaster Recovery | EFROS" description: "Tested backups, documented recovery, contracted RTO and RPO. Built for SMB and mid-market companies that need their backups to actually work." canonical: https://efros.com/security/backup-dr/ --- - [Home](https://efros.com/) - /[Security](https://efros.com/security/) - /Backup & Disaster Recovery Service · Backup & Disaster Recovery # Backups that actually work. We test the restore. We rehearse the runbook. We commit RTO and RPO in writing. When the primary tenant goes down at 2 a.m. (it almost never goes down at 10 a.m.), recovery follows a timeline you signed off on. Not one we invent under pressure. By [Stefan Efros](https://www.linkedin.com/in/stefanefros-cyberdefense/), CEO & Founder, EFROS Updated · June 4, 2026 ## Why backups fail when it matters. 01 ### Backups exist but have never been restored The most common failure mode: a green dashboard for years, and the first restore attempt is during a real incident. Untested backups are not backups; they are hopes. 02 ### Ransomware deletes backups too Modern ransomware actors target backup infrastructure first. If your backup target is reachable from the production tenant with the same credentials, it's already compromised. 03 ### Microsoft 365 has no built-in long-term retention Default retention in Microsoft 365 is short and recovery-bin-style. A mailbox lost after the deletion window is gone for good. SharePoint, OneDrive, and Teams chats all need third-party protection. 04 ### RTO and RPO are aspirational, not contractual Most managed-IT contracts include backups but never define how fast recovery has to happen, or how much data loss is acceptable. When something goes down, neither side has a written commitment. 05 ### DR runbooks are missing or out of date Most companies cannot describe in writing exactly what happens in the first hour after a disaster. The team that knew the plan left two years ago. ## What's included. - Microsoft 365 backup (mailboxes, SharePoint, OneDrive, Teams) - Server / VM backup (Hyper-V, VMware, physical Windows / Linux) - Cloud workload backup (Azure VMs, AWS EC2, Microsoft Fabric) - Endpoint-data backup for laptops - Immutable + air-gapped backup tier (ransomware-resilient) - Documented Recovery Time Objective (RTO) per workload - Documented Recovery Point Objective (RPO) per workload - Quarterly test restores with documented results - Annual disaster recovery exercise (tabletop or live) - Encrypted off-site replication (AES-256 at rest, TLS in transit) - Recovery runbook documentation kept current - Reporting against SLA targets, included in monthly executive review ## Frequently asked. ### Do you back up our existing infrastructure or replace it? + We back up what you have. Veeam, Rubrik, Datto, Acronis, Microsoft 365 Backup, whichever platform fits your environment. If your current setup is working and just needs better operations, we keep it. ### How often do you test restores? + Quarterly at minimum. Critical workloads (Microsoft 365 mailboxes, primary file shares, ERP) test every month. Test results, including any failure, are documented in your monthly executive review. ### What is your typical RTO / RPO? + Depends on workload class. Critical services typically target RTO under 4 hours and RPO under 1 hour. Standard services target RTO 24 hours, RPO 4 hours. Bulk archive can be 72 hours / 24 hours. The exact targets are negotiated and contractually defined per workload during onboarding. ### Is the backup tier ransomware-resilient? + Yes. Backups land in an immutable + air-gapped tier that uses separate credentials, separate network paths, and write-once retention. Even if the primary tenant is compromised, the backup target cannot be deleted within its retention window. ### Do you handle disaster recovery, not just backup? + Yes. Backup is the data part. DR is the runbook part: who pages who, in what order, with which authority. Both are operated together. Annual DR exercise included with the Fortress SOC tier. [Run Free Security Score](https://efros.com/tools/security-scan/) [Talk about your recovery plan](https://efros.com/contact/?type=backup-dr) Related programs [### Incident Response Retainer Pre-engaged commander when ransomware lands and backups become the difference between recovery and ruin.Open→](https://efros.com/security/incident-response/) [### Microsoft 365 Security Tenant hardening + M365 backup coverage — the SaaS layer most backup vendors miss by default.Open→](https://efros.com/security/microsoft-365/) [### Endpoint Security EDR + XDR layered with endpoint backup — defense in depth so a single endpoint failure isn't terminal.Open→](https://efros.com/security/endpoint/) [### Managed Detection & Response Detection-and-response above the backup layer. Catches the threat before backups have to save you.Open→](https://efros.com/security/mdr/) Related EFROS resources ## Resilience program stack [### MDR — early ransomware detection Detection that minimizes blast radius before backup-restoration becomes the answer.Open→](https://efros.com/security/mdr/) [### Incident response — recovery phase Coordinated restoration with forensic preservation and chain-of-custody.Open→](https://efros.com/security/incident-response/) [### M365 backup (separate from native) M365 native does NOT back up tenant data — third-party backup required.Open→](https://efros.com/security/microsoft-365/) [### Backup as insurance requirement Immutable + offline + tested-restore is a 2026 carrier expectation.Open→](https://efros.com/resources/cyber-insurance-readiness-checklist/) [### Ransomware recovery playbook IR runbook section on backup restoration sequencing.Open→](https://efros.com/resources/incident-response-runbook/) [### Healthcare backup (HIPAA + HHS) HIPAA backup + retention + HHS guidance on healthcare ransomware.Open→](https://efros.com/industries/healthcare/)