Managed IT
We design backups on the assumption that someone will try to destroy them, keep a copy out of an attacker's reach and test it all by restoring.
In short
Backup and disaster recovery keeps copies of your data and systems safe and gets your business working again after deletion, hardware failure or ransomware. Catharsis is a Sydney cyber security company. We back up Microsoft 365, devices and servers, protect the copies from attackers and check them with regular restore tests.
01Who it's for
It suits organisations that would stop working without their email, files or main business system.
02What's included
Back up
Email, OneDrive, SharePoint, Teams and Google Workspace data backed up outside the platform, so deleted, overwritten or encrypted files can be restored within the retention period you agree with us.
Servers, virtual machines and important workstations backed up on a schedule that matches how much data you can afford to lose, agreed with you system by system.
Protect & test
At least one copy kept separate from your network, with immutable or offline storage and separate credentials, so an attacker who reaches your systems has a much harder time deleting your backups too.
We regularly restore files, mailboxes and whole systems to check that backups can be recovered, and give you a written record of each test, including how long the restore took.
Recover
A written plan setting out what gets recovered first, how long each system can be down, who makes decisions and the steps to bring services back.
Where downtime would be costly, the ability to restore important servers into the cloud while your own hardware is repaired or replaced, so staff can keep working in the meantime.
Managed IT
Not every system needs restoring at once. We work with you to rank systems by how much each one stops the business, so the recovery plan brings back the finance system or client files before the archive.
03In detail
A complete backup covers every place your data lives, not just the server in the corner:
We follow the 3-2-1-1 rule: three copies of your data, on two different types of storage, one kept off-site, and one that an attacker can’t change or delete. Backup and recovery can run on its own or as part of a managed IT support plan.
Microsoft now offers Microsoft 365 Backup, which keeps restore points inside the Microsoft 365 data trust boundary. That is useful for fast restores, but it shares an admin plane with the data it protects. A copy outside your tenant still matters if an attacker takes over a global admin account or your tenant is locked.
A backup that sits on the same network, using the same admin account, can be encrypted along with everything else. Modern ransomware groups look for backups and try to delete or encrypt them first. As well as keeping a protected copy apart from your network, we put the backup system behind its own credentials protected with multi-factor authentication, and raise an alert on unusual activity such as mass deletion.
Regular backups are one of the controls the Australian Signals Directorate (ASD) prioritises, and they carry over into ASD Essentials, ASD’s new framework. The maturity model organisations are assessed against today requires backups to be tested and protected from unauthorised changes or deletion. These controls are designed to help you meet it.
You only know a backup works when you have restored from it. A job that reports success can still be missing files, or produce data that won’t open. The written record of each restore test is also useful evidence for insurers, auditors and customers.
04The process
We list your data and systems, agree how much data loss and downtime each one can tolerate, and check what is backed up today.
We set up backups for each system, with protected copies kept apart from your production environment.
We write your disaster recovery plan, including priorities, contacts and step-by-step recovery procedures.
Backup jobs are checked for failures, and restores are tested on a set schedule with results reported to you.
05Frameworks
Useful for your auditor, board or procurement team. The mapping shows where this service supports each framework. It doesn't replace a formal assessment.
| Control | ASD maturity model (current) | ISO/IEC 27001 | NIST CSF |
|---|---|---|---|
| Scheduled, protected backups | Regular backups | A.8.13 | Protect (PR.DS-11) |
| Restore testing | Regular backups | A.8.13 | Protect (PR.DS-11) |
| Disaster recovery plan | Not applicable | A.5.29, A.5.30 | Identify (ID.IM-04); Recover (RC.RP-01) |
| Separate backup credentials | Regular backups | A.8.2, A.8.13 | Not applicable |
06Pricing
Pricing*
Quoted for your environment
What changes the price
Server, virtual machine and cloud recovery options are priced on the amount of data, how often it is backed up, how quickly it must be recovered and how long copies are kept. Disaster recovery planning is quoted as a project. In a managed IT plan, endpoint backup starts from $15 per device per month and server backup from $149 per server per month, ex GST, and Secure+ includes it.
Not included: stopping ransomware before it spreads. That is the job of endpoint security, and the two work together.
07FAQ
Can't see your question? Ask a specialist and get a straight answer.
Ask a specialistNot completely. Microsoft keeps the service running and protects against its own hardware failures, but recovering from accidental deletion, a malicious insider or ransomware that syncs into OneDrive is largely the customer's responsibility. Built-in recycle bins and retention settings help for a limited time, but they are not an independent copy you control.
Backup is keeping copies of your data. Disaster recovery is the plan and capability to get your business working again after a major failure, such as ransomware or the loss of a server. You can have good backups and still be down for days if nobody knows the order to restore systems in. We cover both: the copies and the plan to use them.
Retention is agreed with you for each type of data, based on how far back you might need to restore and any record-keeping duties, such as tax, employee or client records you must keep. A longer retention period costs more to store, so we match it to what you actually need. The agreed periods are written into your backup design, so everyone knows how far back a restore can go.
Recovery point objective (RPO) is how much data you can afford to lose, measured in time since the last backup. Recovery time objective (RTO) is how long a system can be unavailable before it seriously hurts your business. Your accounting system might need a short RTO, while an archive can wait. Agreeing these numbers for each system decides how we design your backups.
Backups should be tested regularly by actually restoring data. Small restores, such as a file or a mailbox, are quick to test often. A full recovery of an important system takes more planning, so it is usually tested less often but still regularly, and after major changes to that system. Each test should record what was restored and how long it took.
Backup copies are stored in Australia, separately from your production systems, so a failure or attack on one is less likely to affect the other. Where data is stored matters for privacy, contracts and government requirements, including the Australian Privacy Principles. We document where your copies are held for your records and for questionnaires from customers or auditors.
Talk to our team
No obligation. You talk to the people who do the work.
