Assume breach.
Guarantee recovery.
Backups that ransomware cannot encrypt, recovery objectives you have actually tested, and controls that stop sensitive data leaving in the first place, engineered to the 3-2-1-1-0 standard and proven by restore tests you can show an auditor or an insurer.
Ransomware is a backup attack first
Modern ransomware crews spend days inside a network before encrypting anything. Their first objective is your backups: delete the snapshots, encrypt the repository, disable the backup service account. When backups sit on the same network, under the same credentials, with no immutability, the ransom note is the only recovery plan left.
Data protection is the discipline of making that playbook fail, and of knowing, from evidence rather than hope, how long recovery takes and how much data you would lose. It also covers the quieter failure: sensitive data walking out through email, personal cloud storage, or a departing employee's USB drive.
The protection architecture
Classify, capture, protect the copies, prove recovery, recover, prevent loss, in that order, because each stage depends on the one before.
Classify & tier
- Business impact analysis: for each application and data set, the cost per hour of downtime and the tolerable data loss.
- Tiering into recovery classes (Tier 0 identity and infrastructure, Tier 1 revenue systems, Tier 2 operations, Tier 3 archives), each with a Recovery Time Objective (RTO) and Recovery Point Objective (RPO).
- Data classification (public, internal, confidential, regulated) that drives both retention and DLP policy.
Capture
- Servers and virtual machines: image-level backups with application-consistent snapshots for databases, Exchange, and line-of-business systems.
- Microsoft 365 and Google Workspace: independent backup of mail, OneDrive / Drive, SharePoint, and Teams. The platforms' native retention is not a backup, and their shared-responsibility terms say so.
- Endpoints: policy-based backup of user data on laptops that leave the office.
- Cloud workloads: native snapshots plus cross-account or cross-region copies, so a compromised cloud account cannot delete its own history.
Protect the copies
- Primary off-site copy on immutable storage (object lock / WORM), with retention that cannot be shortened, even by an administrator.
- Backup infrastructure on its own segment with its own identity or local accounts, never domain-joined to the environment it protects, with MFA on every console.
- Encryption in transit and at rest with keys held outside the backup platform. Job failures, repository health, and any attempt to change retention are routed to the SOC.
Prove recovery
- Automated daily verification that each backup boots or mounts.
- Quarterly restore tests at three levels: individual files and mailboxes, whole systems, and a full-site scenario for Tier 0 and 1, timed against the RTO.
- Annual disaster-recovery exercise with your leadership: a scripted scenario, decisions made in real time, and a written after-action report.
Recover
- Clean-room recovery: restore into an isolated network, scan with EDR and indicator-of-compromise checks before anything rejoins production.
- Identity first: Tier 0 (domain controllers, Entra Connect, PKI) rebuilt or restored and credentials rotated before application tiers.
- Cloud or secondary-site failover for Tier 1 systems when the primary site is unusable; documented failback.
- Coordinated with incident response, counsel, and your insurer; evidence preserved throughout.
Prevent loss
- Sensitivity labels and DLP policies for email, Teams, SharePoint / OneDrive, and endpoints: block, encrypt, or warn by classification.
- Removable-media control, personal-cloud upload blocking, and printing controls where regulation requires.
- Insider-risk signals: mass downloads before a resignation, unusual sharing, correlated by the SOC.
- Retention and legal hold aligned to PIPEDA / PIPA, HIPAA, PCI, and your contracts: keep what you must, delete what you should.
What we deliver
Backup, recovery, continuity, and loss prevention as one service with one set of evidence.
Immutable backup & recovery
Design and operation of backups for servers, VMs, endpoints, and cloud workloads with immutable off-site copies, isolated infrastructure, and daily verification.
Microsoft 365 & Google Workspace backup
Independent, searchable backup of mail, files, sites, and chat with granular restore (a mailbox, a single file, an entire site) and retention beyond platform defaults.
Disaster recovery & business continuity
RTO / RPO tiering from a business impact analysis, DR runbooks, cloud or secondary-site failover, and annual exercises with leadership.
Ransomware recovery
A rehearsed procedure: isolate, preserve evidence, rebuild Tier 0, clean-room restore, verify, fail back, coordinated with incident response and your insurer.
Restore testing & assurance
Quarterly tests at file, system, and site level, timed against objectives, with reports suitable for auditors, insurers, and boards.
Data loss prevention
Classification, sensitivity labels, DLP across email, collaboration, and endpoints; removable-media and upload controls; insider-risk signals to the SOC.
Retention & legal hold
Retention schedules mapped to statute and contract, defensible deletion, and legal-hold workflows that survive staff turnover.
Backup for regulated data
Residency, encryption, and retention designed for PIPEDA / PIPA, HIPAA, and PCI DSS scope, with evidence collected automatically.
How the engagement runs
We will not quote a recovery time until we have measured one. The first eight weeks are about getting to that measurement.
- Application and data inventory with owners
- Downtime cost and data-loss tolerance per system
- Recovery tiers and RTO / RPO targets agreed with leadership
- Backup architecture: immutability, isolation, retention, encryption
- SaaS, endpoint, and cloud workloads onboarded
- DLP policy design in audit mode
- First restore tests at all three levels
- DR runbooks written and walked through
- DLP moved from audit to enforcement by data class
- Daily verification, job and repository monitoring
- Quarterly restore tests, annual DR exercise
- Monthly protection report; retention and DLP tuning
Platforms we operate
Vendor-neutral on backup software; uncompromising on immutability and isolation.
Protection standards
The architecture rules we apply to every client, and the evidence that shows they hold.
| Area | Standard | Evidence you receive |
|---|---|---|
| Backup architecture | 3-2-1-1-0: three copies, two media, one off-site, one immutable, zero verification errors | Architecture document and monthly compliance check |
| Immutability | Off-site copy on object-lock / WORM storage; retention cannot be reduced by any administrator | Immutability configuration proof |
| Isolation | Backup infrastructure on its own segment with separate credentials and MFA; never domain-joined | Segmentation and access review |
| Verification | Every backup verified daily (boot / mount); failures ticketed the same day | Daily job and verification status in the monthly report |
| Restore testing | Quarterly file, system, and site-level tests timed against RTO; annual DR exercise | Restore test reports with timings |
| Recovery objectives | Set per tier from the BIA, typically Tier 0/1 RTO in hours with RPO of 15 minutes to 1 hour; Tier 2/3 RTO of 1 to 3 days with RPO 24 h | RTO / RPO matrix, reviewed annually |
Objectives become commitments only once tested. We publish first-test results before any figure appears in your agreement.
Where this lands in your compliance programme
Backup and recovery are the controls insurers now check first and auditors test most directly.