Backup and incident recovery
Ransomware and account takeover both try to leave you without your files. Recovery depends on copies an attacker cannot reach and a plan you have worked through before you need it.
What is backed up
- Exchange Online: every mailbox, with calendars and contacts.
- SharePoint and OneDrive: document libraries and personal drives.
- Microsoft Teams: conversations and files.
Outside the tenant, out of reach
Microsoft keeps its service running, but its own retention has limits. If an attacker takes over an admin account, data can be deleted across the tenant in one go. Our backup is held outside your tenant, where that account cannot reach it.
Restores are tested
We run test restores on a schedule. The date and result of the last one appear in your monthly report and your documentation register, so you know the backup works before the day it matters.
When an incident happens
- Triage. The 24/7 SOC investigates the alert and, where needed, contains the affected device or account.
- Contain. Our engineers reset credentials, revoke sessions and remove anything the attacker set up, such as mail forwarding rules.
- Recover. Affected laptops are rebuilt through Windows Autopilot and files are restored from backup.
- Record. We give you a written timeline of what happened and what was done, which you and your advisers can use for any assessment you need to make.
The data breach readiness guide explains the Notifiable Data Breaches scheme in general terms and what an incident response plan should cover.
Find out where your practice stands.
Let us know your headcount and what you run today. We reply within one business day, and the first assessment is free and read-only.