Managed Detect, respond, recover
Managed backup and disaster recovery
If ransomware hit tonight, could you restore tomorrow? We keep immutable, off-site copies of your data and rehearse the recovery with you.
- Backups
- Immutablecan't be changed or deleted in the retention period
- Coverage
- M365 + serversplus endpoints and Google Workspace
- Restore tests
- Every [x] monthsproved, not assumed
- Recovery targets
- Agreedper workload, in writing
01 / The problem
A backup you've never restored is a hope.
Ransomware goes for backups first
Attackers look for backup copies and delete or encrypt them before they touch live data.
Microsoft 365 isn't a backup
Microsoft keeps the service running. Recovering a deleted mailbox or a wiped SharePoint site is on you.
Restores go untested
Many teams have never tried a full restore. They find the gaps on the worst day to find them.
02 / What’s included
Copies they can't touch. Recovery you've rehearsed.
Immutable off-site backup
Copies held off site that can't be changed, encrypted or deleted until retention ends, even by an admin.
Microsoft 365 and Google Workspace
Exchange, SharePoint, OneDrive, Teams, Gmail and Drive, restorable down to a single email or file.
Servers, VMs and endpoints
Physical servers, VMware, Hyper-V, cloud workloads and laptops, managed from one platform.
Disaster recovery as a service
Your critical systems started in the cloud during an outage, so the business keeps running while we repair.
Daily monitoring
We check backup jobs every day and fix failures before they become gaps.
Restore tests and recovery rehearsals
Regular test restores, plus a planned recovery run-through with your team.
[Placeholder: offer for this service, written by ITB]
03 / How it works
From first backup to a rehearsed recovery.
- Assess and set targets We map your data and agree RPO (how much data you can lose) and RTO (how long you can be down).
- Deploy and protect Agents and cloud connectors go in, with retention and immutability set to your targets.
- Monitor and test Daily checks on every job, and regular test restores to prove the data comes back.
- Rehearse recovery We run the recovery with you, time it against your targets and fix what slows it down.
Everyone has backups. Fewer have restored from them. We make sure you have.
How ITB runs backup
04 / Why ITB
Backup run by a security team.
Most backup is sold as storage. We treat it as your last line of defence against ransomware, and run it alongside the controls that stop the attack.
- Immutable copies: protected copies attackers can't delete, even with admin access.
- Tested, not assumed: restore tests and recovery rehearsals on a schedule we agree with you.
- One provider for the whole incident: the team that runs your backup can also run your SOC and incident response.
- One service, many workloads: Microsoft 365, Google Workspace, servers, VMs and endpoints under one contract.
· 05 / Questions
Backup and DR, plainly answered.
Q01 What does immutable backup mean?
An immutable copy can't be changed, encrypted or deleted until its retention period ends. That holds even if an attacker gets admin access. It means ransomware on your network can't reach your last good copy.
Q02 Does Microsoft 365 need backing up?
Yes. Microsoft runs the service, but protecting your data is your job. Retention settings and the recycle bin don't cover every case, such as a malicious deletion found weeks later.
Q03 How quickly can we recover?
A single file or email usually comes back in minutes. A full server or site depends on how much data there is. We agree recovery targets per workload at the start, then test against them.
Q04 What's the difference between backup and disaster recovery?
Backup gives you copies to restore from. Disaster recovery starts your critical systems somewhere else, usually the cloud, so you keep working while the main site is fixed.
Q05 Will this help with Cyber Essentials, ISO 27001 or cyber insurance?
It helps you show evidence. Insurers and auditors commonly ask about backups, offline or immutable copies and restore testing. Our monthly reports and test records answer those questions.
Related services
IRaaS
The team that leads the incident while backup brings you back.
See the serviceManaged SIEM / SOC
Spots the attack before it reaches your backups.
See the serviceEDR / XDR / MDR
Stops ransomware on the endpoint so you restore less.
See the serviceSecurity Control Validation & Red Teaming
A wargame is a good way to test your recovery plan.
See the service· [Placeholder]
[Placeholder] [Placeholder]
[Placeholder: written by ITB]