Every provider of managed backup and recovery services will tell you your data is backed up. Far fewer can tell you how long it would take to get your business running again, because they've never timed it.
That gap is the whole point of this guide. A green tick on a nightly backup report proves a job ran. It doesn't prove the data is complete, uncorrupted, reachable when your network is encrypted, or restorable before your customers give up waiting.
So instead of ranking brands, this guide compares the four types of service on offer and gives you five tests to run on any shortlist: disaster recovery readiness, proof of restore, security controls, data location, and how fast real humans respond when it all goes wrong.
One reason to do this now rather than later: since 1 January 2026, the federal government has moved from education to active enforcement of ransomware payment reporting for businesses turning over more than $3 million (Home Affairs fact sheet). A backup you can trust is the difference between filing that report and never needing to.
Most offers fall into one of four models. They're often sold under the same label, so it pays to know which one is actually on the quote.
1. Monitored backup. Your provider installs and watches backup software, usually copying data to a cloud store. They fix failed jobs. Recovery is a file restore, done on request. Cheapest, and fine if you could survive a few days of downtime.
2. Backup as a service (BaaS). A fuller managed platform covering servers, endpoints and cloud apps like Microsoft 365 or Google Workspace, with retention policies and tamper protection built in. Still mostly about getting data back, not systems.
3. Disaster recovery as a service (DRaaS). The provider keeps replicas of your critical systems ready to start in their cloud. If your office server or primary environment dies, you fail over and keep trading while it's rebuilt. This is where recovery is measured in hours, not days.
4. Continuity bundled into managed IT services. Backup, DR, security monitoring and incident response folded into a single managed IT services agreement. One throat to choke, which is a genuine advantage in a crisis, provided the backup piece isn't an afterthought.
A quick word on cloud apps. Recycle bins and version history in Microsoft 365 or Google Workspace are useful, but they live inside the same tenant an attacker or a rogue admin can reach. They're a convenience, not an independent backup. Whatever model you choose, confirm your SaaS data is covered by it.
Start with two numbers, and make the provider help you set them, not the other way round.
Recovery time objective (RTO): how long each system can be down before the damage becomes serious. Recovery point objective (RPO): how much recent work you can afford to lose. A tradie's job-management app might tolerate a day down and four hours of lost data. A medical clinic's booking system probably can't tolerate either.
Those numbers decide the model. If your answers are measured in days, monitored backup or BaaS will do. If they're measured in hours, you need DRaaS or something like it, and no amount of reassurance changes that arithmetic.
A good provider will push you past the server room. Business continuity is broader than disaster recovery: who rings customers, which staff work from where, how you take payments while systems are down, who has the provider's after-hours number when the email system is the thing that's broken. If their continuity plan fits on a single slide about cloud replication, it isn't a continuity plan.
Ransomware deserves its own scenario. A fire destroys your data; ransomware destroys it and then waits to see whether your backups are reachable. Ask the provider to walk you through recovery assuming your network, email and admin accounts are all compromised at once. That's the realistic case, not the worst one.
This is the test most providers fail, and the one that matters most.
The Australian Signals Directorate's Essential Eight, a baseline many Australian insurers and auditors reference, requires restoration from backups to be tested as part of disaster recovery exercises at every maturity level. One Australian provider's reading of Maturity Level One is daily backups of servers and cloud services, 90 days' retention unless something more specific applies, and restore tests at least annually (AC3). Annual is the floor, not the goal.
Ask to see evidence, not a policy. A provider who tests properly can show you:
Automated restore verification (where software boots a backup copy and checks it starts) is a useful extra. It doesn't replace a person confirming the payroll system opens and the numbers are right.
Attackers know backups are your way out, and they go after them first, before the ransom note appears (AC3). So the real security question isn't whether your data is backed up. It's whether someone holding your admin password could delete the backups.
Four controls answer that:
One more: ask how the provider secures its own staff access to your environment. Attackers getting in through a trusted IT provider is a well-documented pattern. Your provider's remote-access tooling is part of your attack surface.
"Your data is stored in Australia" is a sentence worth taking apart. Ask where the primary backup lives, where the secondary copy is replicated, where the provider's support staff sit, and where the platform's management console is hosted. The answers are often different.
Why it matters for Australian SMBs:
Onshore isn't automatically safer, and offshore isn't automatically non-compliant. What you want is a provider who can draw you a map of every copy, and put it in the contract.
Read the service level agreement for two words: response and resolution. A 15-minute response time means someone acknowledges your ticket. It says nothing about when you're trading again. Ask for a committed restore time for critical systems, and what happens (credits, escalation, a named person) when it's missed.
Then check the hours. Ransomware tends to detonate on Friday nights and long weekends, when fewer people are watching. If the provider's "24/7 support" is an answering service that pages someone on Monday, you want to know now.
The bigger question is where backup ends and incident response begins. They're different jobs:
Restore too early and you can reinfect yourself from a backup that already contained the attacker, or wipe the evidence your insurer needs. A good provider will tell you plainly whether they do incident response or hand over to a specialist, often one on your cyber insurer's panel. Either answer can work. "We'll figure it out on the day" can't.
The hand-off matters for compliance too. If a business turning over more than $3 million pays a ransom, it has 72 hours to report to the Australian Signals Directorate, including details such as the ransomware variant and the vulnerabilities exploited, where known (Home Affairs fact sheet). Paying isn't generally illegal, but the government strongly discourages it. Recoverable backups are what let you refuse.
No model wins every test. Use the table to see which one matches your recovery numbers, then use the five tests to judge the providers selling it.
|
Service model |
Typical recovery |
Restore testing |
Security controls |
Incident response |
Best for |
|---|---|---|---|---|---|
|
Monitored backup |
Days; file-level restores |
Often ad hoc unless contracted |
Varies widely; check immutability |
Usually none |
Sole traders and micro-businesses with tolerant RTOs |
|
Backup as a service |
Hours to days for data; systems slower |
Platform tools help; full tests still need contracting |
Usually strong: immutability, MFA built in |
Rarely included |
SMBs heavy on Microsoft 365 or Google Workspace |
|
Disaster recovery as a service |
Hours; failover to provider's cloud |
Failover tests are part of the service |
Strong, but replicas need the same protection |
Sometimes; check the hand-off |
Businesses that lose real money per hour down |
|
Continuity in managed IT services |
Depends on what's bundled |
Should be scheduled and reported |
Covered alongside endpoint and identity security |
Often included or pre-arranged |
SMBs without in-house IT wanting one accountable provider |
The pattern: the higher your cost of downtime, the further down the table you belong, and the more the restore-testing column should weigh in your decision.
Ask every shortlisted provider the same ten, in writing.
Questions 2, 5 and 8 do the most work. A provider who hesitates on any of them is telling you what the day of the disaster will feel like.
Ask your current provider for one thing: the report from your last full restore test. If it exists, check the date and whether the restore beat the time your business can actually survive. If it doesn't exist, you've learned more in one email than any sales meeting will tell you.
Then set your recovery numbers, pick the model that matches them, and run the five tests on anyone quoting for the work.
The best managed backup and recovery services aren't the ones with the longest feature list. They're the ones that have already proved, on a date you can see, that they can bring your business back.