Backup and recovery
readiness, with evidence.
We review what is backed up, how those backups are protected and whether you have evidence that you could restore them, across Microsoft 365, Azure and on-premises systems, and give you a written report of gaps and the fixes to do first.
Who it is for
Organisations that have backups but cannot say what they would recover, how fast, or whether anyone has tested it, or that want to check readiness for a ransomware event, an audit or a cloud migration.
What we review
- Coverage inventory. a list of systems and data, and for each: protected, not protected or unknown. This includes Microsoft 365 mailboxes, SharePoint, OneDrive and Teams, Azure VMs and databases, on-premises servers and software-as-a-service data.
- Microsoft 365 data. what your retention settings and recycle bins give you, what they do not, and whether a separate backup exists. Microsoft 365 Backup is one Microsoft option and covers SharePoint sites, OneDrive accounts and Exchange mailboxes. Check current Microsoft documentation.
- Azure Backup. vault and policy configuration, retention against your recovery targets, and whether the optional protections Microsoft documents are used: immutability for Recovery Services vaults and multi-user authorization with Resource Guard.
- On-premises backup. the product in use, job success history, offsite and offline copies, and immutability or air-gap protection.
- Active Directory and identity. whether domain controllers and identity configuration are backed up and recoverable, because most recovery depends on identity first.
- Recovery targets. documented recovery time and recovery point objectives per system, compared with what the backup schedule and tooling can deliver.
- Restore-test evidence. dates, scope and results of recent restore tests, and whether tests covered a full system and not only individual files.
- Backup administration security. separate administrator accounts, multi-factor authentication on the backup console and whether backup servers are reachable from ordinary workstations.
- Monitoring. alerting for failed or missed jobs and who responds.
- Ransomware recovery path. the order in which systems would be restored, a clean recovery environment, an offline copy of the runbook, and a contact tree.
- Dependencies. DNS, certificates, licensing and secrets that a restore would need.
What you get
A written report, delivered through the channel agreed in the quote. It contains:
- An executive summary in plain language
- A coverage table: system, protection, recovery target, last test
- Findings with severity and the evidence behind each one
- A draft recovery order for your critical systems
- A fix-first list, a 30/60/90-day plan, and a list of what was not checked
See the format in the fictional report sample (sample, fictional data).
What we need from you
- A named contact with authority over backups
- Backup job reports, policy exports or screenshots named in the scope, and any recovery documents you hold
- Your recovery targets, or an honest note that none exist
How it works
- Send an enquiry. Tell us the question. Keep credentials and customer data out of it.
- Agree the written scope. We propose scope, fee and timing in writing. Nothing starts until both sides accept it.
- We review what you choose to share. We read only the reports and documents in the agreed scope. We do not log in to backup systems or restore anything.
- You get a written report. It says what was checked, what was not, and suggested next steps.
- Any change is approved separately. A report does not authorize changes; anything that changes needs its own written approval.
See what the report looks like: Read a fictional report sample (sample, fictional data). How we handle your information: Trust and data handling.
What we need from you. A named contact with authority, and a small set of evidence you choose to share through a channel we agree in writing first. Please do not send credentials, access tokens or customer exports through the enquiry form.
What we do not do. We do not log in to your backup tools, run or schedule restores, change retention or copy data. We give no recovery guarantee.
What needs separate approval. Any restore test, change to retention or immutability, backup product change, and any follow-up check after changes.
Questions before an enquiry
Do you test restores?
No. We review the evidence that you did. A live restore test needs a separate scope, an isolated environment and your approval.
Is Microsoft 365 already backed up by Microsoft?
That depends on your retention settings and on any backup service you use. Microsoft offers Microsoft 365 Backup, which covers SharePoint sites, OneDrive accounts and Exchange mailboxes. The report maps what you have to what you need. Check current Microsoft documentation.
Will you recommend a product?
We describe the gaps and the options. Choosing and buying a product is a separate decision.
What if we have no recovery targets?
That is a finding. The report suggests how to set them with the business.
Does this cover disaster recovery?
It covers backup and recovery readiness. Full disaster recovery design, failover testing and site resilience need their own scope.
Free tools, reading and vendor documentation
Microsoft documentation (opens in a new tab). Product behaviour and licensing change, so check current Microsoft documentation before acting:
Ready to start?
Tell us what you need. We reply to confirm fit and to propose scope, fee and timing in writing.