A backup you have
actually restored.

Backup and recovery covers what is backed up, how often, where the copies live, how long they are kept, and the part that actually matters, which is proof that a restore works. It is for every organisation, because almost all of them have a backup and very few have tested it.

Not in the way most people assume, and this is the single most common dangerous misunderstanding we encounter. Microsoft keeps the service running and offers limited retention windows. Under their shared responsibility model your content is your responsibility. Deleted items age out, a departing employee’s OneDrive can disappear with their licence, and ransomware that encrypts synced files simply syncs the encryption. A separate backup is a distinct product and you should have one. The same is true of Google Workspace.

At least quarterly for the systems you could not trade without, and any restore should be evidenced rather than asserted. A backup that has never been restored from is a hypothesis. The failures we find are rarely the backup job itself. They are the restore taking eleven hours when the business assumed two, or a critical system quietly falling out of scope when it was migrated.

Three copies of your data, on two different types of storage, with one copy off site. It is a good rule of thumb and it predates ransomware, so the modern addition is that one copy should also be immutable, meaning it cannot be changed or deleted even with valid administrator credentials. That last point is what stops an attacker destroying the backups before encrypting the systems, which is now standard practice for them.

Longer than the backup software suggests, because restoring data is only part of it. You also have to establish how the attacker got in and close it, rebuild systems rather than restore them if they were compromised, verify data integrity, and do it all while the business is not trading. Organisations that have rehearsed it recover in days. Organisations that have not are often measured in weeks, and this is exactly what a continuity plan and a tested restore are for.

The New Zealand government position, and ours, is that you should not. Payment funds the next attack, marks you as a business that pays, and buys a decryption tool that is frequently slow and incomplete. There are documented cases of organisations paying and still losing data. The decision is yours and there are circumstances where a board genuinely agonises over it, which is the strongest possible argument for having tested backups so that the question never has to be asked.

Increasingly yes. Policies now commonly ask whether backups are tested, whether a copy is off site, and whether a copy is immutable or otherwise isolated from the production environment. Answering optimistically on a proposal form is a genuinely bad idea, because a claim can be declined on the basis of what you stated. If you are unsure of the honest answer, that is worth establishing before renewal rather than after an incident.

We quote after scoping rather than before. Anyone pricing this work without looking at your environment is guessing, and the guess is rarely in your favour. Scoping itself is quick, and we tell you what it costs before we start it.

A first conversation takes about half an hour and costs nothing. Scoping is usually a week or two of our time depending on the size of the environment, and we agree the delivery dates with you before anything is booked in.

Yes, and it is common. We are happy to work as an extra pair of hands under your internal team, or alongside an incumbent provider on a defined piece of work. We will set out in writing where the responsibilities split, so nothing falls between us.

No. This can be delivered as a standalone piece of work for an organisation we have never worked with before, or folded into a managed agreement if you already have one with us. Plenty of clients use us for one thing and keep everything else where it is.

Our team is based in Auckland and we attend sites across the wider region. Most of this work is delivered remotely, so we support organisations throughout New Zealand, and we will say up front where being on site genuinely matters.

Named people, not a queue. You get a lead who knows your environment and stays with it, which is the difference between explaining your business once and explaining it every time you make contact.

You keep the documentation regardless, and anything registered in your name stays in your name. Whether we stay involved is your call. Some clients take it in house from there, others move it onto an ongoing agreement with us. We would rather you left cleanly than stayed because leaving was difficult.