Backup & Recovery
Everyone has backups. Far fewer can restore.
Backup is the one SMB1001 control required at every single tier, and the one that gets tightest as you climb. We set it up, we test the restore, and we keep the evidence that proves it works.
Why it matters
The control an insurer will ask about first
When a claim is made or a customer sends an assurance questionnaire, backup is where the questions start. Not “do you have backups”, which everyone answers yes to, but “when did you last restore one, and can you show us?”
SMB1001 asks for a documented backup and recovery strategy from Bronze, and raises the bar at every tier above it: an offline or isolated copy, a schedule that is ideally daily, and no less than six months of history you can actually recover from. Most businesses we assess meet the first part and fail the rest.
What we do
Backup that stands up to being checked
Microsoft 365 backup
Microsoft does not back up your tenant for you; retention is not backup.
- Cloud-to-cloud backup of Exchange, SharePoint, OneDrive and Teams
- Retention aligned to your obligations, not just the default
- Point-in-time recovery of mailboxes, sites and individual files
Server, endpoint and on-site backup
For the systems that still live in your building.
- Image-level backup of servers and virtual machines
- An offline or logically isolated copy, as the standard requires
- Off-site replication so a fire or a ransomware event does not take both copies
Restore testing: the part that gets skipped
A backup nobody has restored is a hypothesis, not a control.
- Scheduled restore tests, performed and documented
- Recovery time measured against what your business can actually tolerate
- Written records you can hand to an insurer, an auditor or a customer
Evidence and reporting
- Backup job success and failure reporting, reviewed rather than just emailed
- Retention and history evidence mapped to the SMB1001 control
- Documentation that slots straight into your certification evidence pack
Honest note
Six months of history takes six months
If your target tier asks for six months of recoverable history, configuring it correctly today does not give you six months of history today; it starts the clock. We will tell you that up front and record where you genuinely stand, rather than ticking a box that would not survive being examined. It is the same discipline we apply to our own environment.
Find out whether your backups would actually restore
We will look at what you have, test a restore, and tell you plainly.