Disaster Recovery Services (BCDR)

Elscomm provides disaster recovery services for Sydney businesses of 15 to 70 staff. You get managed backups, tested restores and a team to carry out the recovery when a server fails, ransomware hits or the office goes offline. Business continuity covers the wider question: how the business keeps working while IT recovers.

BCDR, short for business continuity and disaster recovery, brings the two together. Planning business continuity starts with what the business can't stop doing, then works back to the systems, backups and IT disaster recovery services protecting it. As part of our managed IT services, we set up business data backup for servers, cloud data and Microsoft 365, and check it restores before you need it. Our IT business continuity services keep the plan tied to the systems you run today.

This page covers what BCDR includes, how backup as a service works, what a BCP (business continuity plan) needs, why Microsoft 365 needs its own backup, the rules after a cyber incident, how to choose a provider and how Elscomm prepares you.

BCDR in numbers

• 3-2-1 the common backup rule: 3 copies of your data, on 2 types of storage, with 1 kept offsite
• $56,600 average self-reported cost of cybercrime per report for a small business in 2024-25, up 14% (ASD)
• 72 hours to report a ransomware payment, for businesses with annual turnover over $3 million
• 30 days to assess a suspected eligible data breach under the Privacy Act

At a glance

• Disaster recovery gets your systems and data back. Business continuity keeps the business working while it happens.
• A backup counts only once someone has tested a restore from it.
• Microsoft 365 recycle bins and retention settings are not a backup.
• Recovery targets (RTO and RPO) are set system by system, based on how much downtime and data loss the business accepts.
• Backup and disaster recovery come with our managed IT services. Your first step is a free IT assessment.

What are disaster recovery services? BCDR explained

Disaster recovery services restore your IT systems, data and applications after an incident. The trigger might be a failed server, a deleted folder, ransomware or a flooded comms room. IT disaster recovery services focus on the technology: backups, restores, failover, network disaster recovery and the order systems come back in. Computer disaster recovery once meant rebuilding one machine. Disaster recovery in IT now covers servers, cloud data and every account your staff log into.

Business continuity is the bigger picture: how staff keep serving clients, who makes decisions and how customers hear from you during recovery. Together they're called business continuity and disaster recovery, or BCDR. A business continuity program covers the plan, the people and the testing. IT disaster recovery solutions cover the technology underneath.

For a business of 15 to 70 staff, good business continuity solutions, or BCDR solutions, are rarely complicated. You need backups someone checks, a short written plan and a team who knows its part. BCDR services from your IT provider should deliver all three.

What a cyber incident costs a business your size

ASD's Annual Cyber Threat Report 2024-25 recorded over 84,700 cybercrime reports, around one every six minutes. The average self-reported cost per report was $56,600 for a small business and $97,200 for a medium business. ASD advises businesses to plan for the disruption a cyber incident causes, and most disaster recovery IT work happens long before anything goes wrong.

Business continuity vs disaster recovery

Business continuity vs disaster recovery isn't an either-or choice. A business continuity disaster recovery plan answers both questions in one document. One without the other leaves a gap.

RTO and RPO: the two numbers behind every plan

The recovery time objective (RTO) is how long a system stays down before it hurts the business. The recovery point objective (RPO) is how much data you can afford to lose, measured as the time since the last good backup. Your practice management or accounting system might need both measured in hours. An archive folder will survive a few days.

When planning disaster recovery, set these per system. They sit at the core of a business continuity strategy and a disaster recovery strategy, and they decide what each disaster recovery solution has to do.

What our backup and disaster recovery services cover

Our data backup and disaster recovery services come as part of our managed IT services, so backup and recovery sit with the same team supporting your systems. They run as managed backup services, sometimes sold as backup managed services or backup management services: checked and maintained, not set up once and forgotten. Any one-off project, such as moving an old server to the cloud, is quoted separately.

• Server backup: cloud based server backup solutions for servers in your office or in Microsoft Azure, with a copy kept offsite
• Microsoft 365 backup: email, SharePoint, OneDrive and Teams data backed up separately from Microsoft's own retention settings
• Business data backup: files and shared folders your team relies on, captured by automated data backup and recovery jobs
• Separate, protected copies: backups kept separate and out of ransomware's reach
• Monitoring: backup jobs watched, with failures picked up and fixed
• Restore testing: restores tested regularly, so you know a backup works before you need it. Without tested backups disaster recovery turns into guesswork.
• Security monitoring: 24/7 security monitoring, with after-hours response to emergencies
• Essential Eight alignment on request: backups set up to meet the Essential Eight regular backups control when an insurer or customer asks for it

The result is managed backup and disaster recovery under one agreement, run by the people who already support your servers and laptops.

Backup as a service and disaster recovery as a service

Backup as a service (BaaS) means your backups run on a provider's platform and are managed for you. The alternative is a box in the comms room someone checks when they remember. A good data backup service runs the jobs, keeps copies offsite, watches for failures and tests restores. Backup as a service providers differ mainly in what they back up, where the copies live and who checks them.

Disaster recovery as a service (DRaaS) goes a step further. As well as copies of your data, whole servers start in the cloud if the office or server is unavailable, a form of disaster recovery hosting. Some providers sell this as business continuity as a service. Backup and disaster recovery as a service combines the two.

Data centre disaster recovery once meant paying for a second site full of standby servers. Cloud disaster recovery services and cloud disaster recovery solutions put those standby servers in the cloud instead. For businesses running mostly in Microsoft 365, cloud based disaster recovery services are often needed for only one or two remaining servers. Cloud backup services and a cloud backup and disaster recovery setup cover the rest. Microsoft 365 itself acts as a business continuity cloud for most teams, because staff keep working from their laptops while an office server is down.

Backup options compared

Most IT backup solutions fall into one of four types. Cloud based backup solutions are now the default for most backup solutions for business, including cloud based backup solutions for servers. Backup and recovery solutions differ most in who checks them.

Corporate data backup used to mean tapes in a fireproof safe, and some offices still run backup tape solutions. Most small business backup solutions we replace are a mix of the first two rows. A managed cloud backup service fixes the two gaps they share. Nobody checks them, and they sit next to what they protect.

Cloud backup for business has mostly replaced the office NAS, but services vary. A good cloud backup service watches its own jobs. A cheaper online cloud backup service may leave that to you. Before you sign up for cloud based backup services for business, ask who reads the failure alerts.

Backup as a service benefits

Managed well, cloud based backup for business and other cloud backup solutions for business give you five things:

• Offsite by default: business cloud backup means a copy survives whatever happens to the office
• Watched: failed jobs get noticed instead of discovered during a crisis
• Tested: restores are proven before you rely on them
• Protected: separate credentials keep backups away from ransomware
• Predictable: part of a monthly managed service, not surprise hardware bills

Where your copies live: cloud backup in Australia

For cloud backup, Australia is the sensible place to keep copies for most businesses, especially those holding personal information. Online backup services Australia buyers compare don't always name their storage region up front. Before you choose between cloud backup solutions Australia providers sell, ask which country each copy sits in and get the answer in writing. The same check applies to any backup as a service Australia offer and to offsite cloud backup solutions in general.

Why Microsoft 365 needs its own backup

Microsoft keeps the Microsoft 365 platform running. Keeping your data recoverable is your job. Recycle bins and retention settings help with recent mistakes. Deleted SharePoint and OneDrive files stay restorable for up to 93 days, and deleted email items are kept for 14 days by default, which an administrator can extend to 30.

After those windows close, the data is gone. Ransomware on a laptop can also sync encrypted files into OneDrive, and a deleted account or a malicious insider can remove data faster than anyone notices. That's why we back up Microsoft 365 separately.

There are two broad routes. Third-party 365 backup solutions copy your data to separate storage. Microsoft's own Microsoft 365 Backup is a separate, usage-based paid service. For OneDrive and SharePoint it keeps restore points every 10 minutes for the last 14 days, then weekly back to a year. It covers Teams channel files stored in SharePoint, not Teams chats. Whichever route you pick, Microsoft 365 backup solutions should keep copies longer than the recycle bins and out of reach of a compromised account.

You'll still hear it called Office 365 backup or O365 backup, and M365 backup is the same thing again. The name doesn't matter. M365 backups and Microsoft 365 backups help only if someone tests a restore.

After a cyber incident: the rules that apply

A disaster recovery plan has to cover more than restoring systems. If an incident involves ransomware or personal information, Australian rules set deadlines.

• Ransomware payment reporting: since 30 May 2025, businesses with annual turnover over $3 million that make a ransomware or cyber extortion payment, or have one made on their behalf, must report it to the Australian Signals Directorate within 72 hours. The education-first phase ended at the start of 2026, so a missed report now risks enforcement.
• Notifiable Data Breaches scheme: if personal information may have been accessed, businesses covered by the Privacy Act must assess a suspected eligible data breach within 30 days, and notify the OAIC and affected people if it is eligible. The OAIC's position is that a ransomware attack where access can't be ruled out generally needs that assessment.
• Essential Eight regular backups: ASD's control expects backups of data, applications and settings, restores tested as part of disaster recovery exercises, and staff accounts unable to change or delete backups. See our Essential Eight page.
• Cyber insurance: insurers commonly ask about backups and multi-factor authentication at renewal, so keep evidence of your backups and restore tests on file.

Tested backups give you options. A business able to restore cleanly is in a far stronger position than one deciding whether to pay. General information, not legal advice.

Planning business continuity: what a plan needs

A BCP (business continuity plan) doesn't need to be a 100-page binder. For a business of 15 to 70 staff, business continuity planning comes down to a few clear decisions, written down and tested. Business continuity planning services should help you work through these:

• Business continuity assessment: which activities the business can't stop, and how long each can pause before clients, cash flow or compliance suffer
• Business continuity risk: what is most likely to disrupt you, from a failed server or ransomware to a power outage, a flood or a key supplier going down
• Recovery targets: an RTO and RPO for each critical system
• Business continuity arrangements: who leads, who decides, who calls clients and suppliers, and how staff keep working in the meantime
• IT disaster recovery procedures: the order systems come back in, where backups are and who has the access to restore them. Write each IT disaster recovery procedure as numbered steps a second person can follow without help.
• Contacts: staff, suppliers, insurer and IT provider details kept somewhere you can reach without your systems
• Business continuity policy: a short statement of who owns the plan and how often it is reviewed
• Testing and review: business continuity testing as a walk-through, and disaster recovery testing of real restores, then updates after any big change

Business continuity and disaster recovery planning works best when the person writing the plan also runs your IT. The plan then matches the systems you have, not the ones a template assumes. IT disaster recovery planning kept apart from day-to-day IT disaster recovery management goes stale the first time a server changes.

Business continuity consulting services vs managed disaster recovery

Business continuity consulting comes in two broad kinds. Business continuity consulting firms, independent business continuity consultants and business continuity planning consultants run workshops, write plans and, for larger organisations, help with business continuity certification under ISO 22301, the international standard for business continuity management. Business continuity management consulting services and business continuity and resiliency services from larger firms suit organisations with a dedicated risk team. Larger firms may split business continuity management and disaster recovery planning into separate workstreams, with business continuity management services sold as an ongoing retainer.

Disaster recovery companies and managed providers run the backups and carry out the recovery. For a business of 15 to 70 staff, the second kind matters most, because a plan works only if someone keeps the backups behind it healthy. Business continuity planning consulting on its own rarely touches a restore. A business continuity planning consultant writes the plan, and someone else still has to run the backups behind it. The most useful business continuity consultant for a business your size is often a business continuity advisor who already runs your IT, rather than one of the business continuity consulting companies who hand over a document and leave.

Elscomm isn't a certification body. We provide business continuity services on the IT side, as business continuity managed services within our managed IT services, and work with your insurer, accountant or lawyer on the rest.

10 questions to ask any backup or disaster recovery provider

Whether you talk to a disaster recovery consultant, one of the business continuity service providers, a backup service provider or one of the large cloud backup service providers, ask these before you sign. Disaster recovery specialists and disaster recovery experts should answer each one easily, and in writing.

1. Where is each backup copy stored, and in which country?
2. Who can delete a backup? Staff and everyday admin accounts shouldn't be able to.
3. When was the last restore test, and what was restored?
4. What are the RTO and RPO for each critical system?
5. Is Microsoft 365 backed up separately from Microsoft's retention settings?
6. What happens if something fails after hours?
7. Who declares a disaster and starts the plan?
8. How will staff know what to do?
9. How often is the plan reviewed?
10. What is included, and what is quoted separately?

There's no single best backup solution. The best backup solutions for a business are the ones someone monitors and restore-tests, whatever the brand, and the same goes for the best cloud based backup solutions. Compare backup disaster recovery solutions on the answers above. To compare providers side by side, see our guide to the best managed service providers in Sydney.

IT disaster recovery for small business teams of 15 to 70 staff

Our clients have between 15 and 70 staff. At that size, one failed server or one compromised account can stop the whole business, and nobody inside has time to plan for it. IT disaster recovery for small business teams needs to be simple, tested and owned by someone. Business disaster recovery at this size usually comes down to a handful of systems: email, files, the accounting or practice software and sometimes one server.

We build backup solutions for small business teams around Microsoft 365 and Azure. That runs from data backup solutions for small business teams with no servers left, to hybrid setups with one or two servers still in the office. There, server backup cloud solutions and other backup to cloud solutions take over from the old USB drive. For many offices, the computer backup services Sydney businesses bought years ago meant exactly that drive. The managed backup services for computers Sydney teams need today run offsite and get checked.

If you're comparing data backup Sydney providers offer, our approach suits:

• Businesses with a server in a comms room and no tested restore
• Teams working mainly in Microsoft 365, SharePoint and OneDrive
• Firms holding client data covered by the Privacy Act
• Businesses whose insurer or customers ask about backups and recovery
• Growing teams that have outgrown a USB drive or an old NAS
• Professional services, accounting, construction and healthcare

Industry pages: accounting, financial services, construction, healthcare, schools, medium businesses and small businesses.

Disaster recovery support: how Elscomm prepares you

Every engagement starts with a free IT assessment, so you know where your backups and recovery stand before you commit to anything. The work runs in four steps:

• Assess: we check what you run, what is backed up today, where the copies are and whether they restore.
• Set targets: we agree recovery targets with you for each critical system, based on the downtime and data loss the business accepts.
• Protect: we set up managed backups for servers, cloud data and Microsoft 365, kept separate and out of ransomware's reach.
• Test and review: we test restores regularly and update your backups as your systems change.

Book a free IT assessment.

Disaster recovery services questions answered

Is business continuity the same as disaster recovery?

No. Disaster recovery gets your IT systems and data back after an incident. Business continuity keeps the business working while that happens: people, processes, suppliers and communication. Most businesses need both, which is why they're planned together as BCDR.

What do disaster recovery services include?

Backups of your servers, cloud data and Microsoft 365, kept separate and checked. Restore testing, and a team to carry out the recovery. With Elscomm, business continuity and recovery services come as part of our managed IT services.

What is backup as a service (BaaS)?

BaaS, backup as a service, means a provider runs your backups on its platform: scheduling the jobs, keeping copies offsite, watching for failures and testing restores, usually as part of a monthly service. You'll also see it called backup and recovery as a service or cloud backup as a service.

What is disaster recovery as a service (DRaaS)?

DRaaS, disaster recovery as a service, lets a provider start your servers in the cloud if your office or server room is unavailable. Cloud disaster recovery as a service keeps the business running while the original systems are repaired or replaced.

Do you back up servers to the cloud?

Yes, as part of our managed IT services. Our cloud based server backup services cover servers in your office and in Microsoft Azure, with a copy kept offsite and restores tested. Server cloud backup solutions like these replace the USB drive or tape older setups relied on.

Does Microsoft 365 back up our data?

Not in the way most people expect. Recycle bins keep deleted SharePoint and OneDrive files for up to 93 days, and deleted email items for 14 days by default, extendable to 30. After that, or if ransomware or a deleted account is involved, data can be lost. A separate Microsoft 365 backup closes the gap.

What is the 3-2-1 backup rule?

Keep 3 copies of your data, on 2 different types of storage, with 1 copy offsite. Many businesses now also keep one copy nobody can change or delete, to protect against ransomware.

What are RTO and RPO?

The recovery time objective (RTO) is how long a system can stay down. The recovery point objective (RPO) is how much data you can afford to lose, measured as time since the last good backup. Both are set system by system.

How often should backups be tested?

Regularly, and after any big change to your systems. ASD's Essential Eight expects restores to be tested as part of disaster recovery exercises. A backup nobody has restored from is a guess.

What happens in a total disaster recovery, such as a fire at the office?

Staff keep working in Microsoft 365 from their laptops while servers and data come back from offsite copies, in the order your plan sets. Total disaster recovery is the scenario the plan exists for, so it belongs in your walk-through tests.

Do we have to report a ransomware attack?

It depends. Businesses with annual turnover over $3 million must report a ransomware or cyber extortion payment to the Australian Signals Directorate within 72 hours. If personal information may have been accessed, businesses covered by the Privacy Act must also assess the incident under the Notifiable Data Breaches scheme within 30 days. General information, not legal advice.

Do you provide business continuity certification?

No. Certification against ISO 22301 comes from accredited certification bodies. We look after the IT side of business continuity: backups, recovery and the systems your plan depends on.

Do you offer disaster recovery services without managed IT?

Not at the moment. Our backup services for businesses come as part of our managed IT services, so the team protecting your data is the team supporting your systems every day. That's why data backup, disaster recovery services and every backup service we run sit inside one agreement. We don't sell a standalone disaster recovery service.

What happens if something fails after hours?

Our help desk runs Monday to Friday, 8am to 5pm. Security monitoring runs 24/7, and we respond to emergencies after hours.

Do you cover all of Sydney?

Yes. We provide business continuity and disaster recovery Sydney-wide from our business address in North Sydney. It's the managed backup service Sydney businesses on our managed IT plans already use, including the data backup services Sydney offices rely on for servers, laptops and Microsoft 365. Business continuity services Sydney NSW businesses need come from the same team.

How do we get started?

Book a free IT assessment. We look at what you run, how it's backed up and whether it restores, then give you a plan and a fixed quote with every extra in writing. Call (02) 8188 9777, Monday to Friday, 8am to 5pm, or book online.

Sources: Australian Signals Directorate, Annual Cyber Threat Report 2024-25, Essential Eight maturity model and ransomware payment reporting guidance. OAIC, Notifiable Data Breaches scheme. Microsoft 365 retention and Microsoft 365 Backup documentation. Last reviewed October 2026.