Data Protection
A backup only counts if it can be restored. We test recovery periodically so incident day isn't the first time.
- Backup
- Recovery
- Immutable copies
- Restore testing
Ransomware goes after backups first.
An attack that reaches the backup removes the only way out without paying. That is why the copy has to be immutable and out of reach of day-to-day administrative credentials. And it has to be tested: most organizations discover their backup did not work exactly when they needed it.
- You've never restored a full system from backup.
- Backup copies sit on the same network and use the same credentials as production.
- There's no agreed recovery time per system.
What the layer includes
Every component is implemented, configured, and left under SOC watch. We don't hand over bare licenses.
Managed backup
Servers, workstations, and cloud services, with retention agreed by data type.
Immutable copies
Cannot be deleted or encrypted within the retention period, not even with compromised administrator credentials.
Recovery plan
Recovery time and acceptable data loss defined per system, with a written, tested procedure.
Restore testing
Periodic, documented restores. Without testing, a backup is just an assumption.
The layer isn't installed and forgotten.
Everything this layer generates flows into the SIEM, gets correlated with the rest of the stack, and is reviewed by an analyst on shift. What follows is the same across all nine layers.
Classified in under a minute
The Triage Agent reviews every event that comes in, at any hour, and discards the noise before it reaches a person.
Confirmed by an analyst
The decision to contain, isolate, or escalate is made by a person with context on your operation, not an automation.
It gets logged
Every action on this layer enters the period's report, with time, owner, and outcome.
- Backup job report, with failures and their cause.
- Record of each restore test with real recovery times.
- Recovery plan status per system.
This layer within the nine
No layer requires the others. Most of our clients start with two or three and move forward based on their reality.
What people ask about this layer
Where are the copies stored?
Defined with you: cloud, an alternate site, or a mixed scheme, considering any data-residency rules that apply to you.
How often is restoration tested?
Quarterly by default for critical systems, and always after a major platform change.
Does it cover Microsoft 365?
Yes. That platform's native retention isn't equivalent to a backup and is covered separately.
What happens if there is a legal request?
Legal hold freezes the relevant information so it can't be deleted while the process is ongoing.
Let's see how this layer stands in your operation.
A free review, no strings attached. We'll tell you what we found, what to fix first, and what to expect.
We respond within one business day. Ecuador, Colombia, Bolivia, the United States, and Canada.