Backup and recovery

Backup and disaster recovery for small businesses in Canada

Our disaster recovery services start with a test. We check what is copied, where the copies live, whether ransomware or a stolen password could reach them, and how long a real restore takes. Then we set up the backups that were missing, prove them by restoring, and write a recovery plan in plain words for the day something fails.

Ask us to call you back Book the free audit

A bookkeeper in her sixties typing at a desktop computer, an external drive plugged in beside the keyboard — A backup counts once someone has restored from it and timed the result.

A person here calls you back the same business day, usually within an hour.

Written permission first
A report in plain words
Checked again after the fix

What backup and disaster recovery services include

Backup and disaster recovery services make sure a copy of every system your business depends on exists, sits out of an attacker’s reach and can be brought back within a time you have agreed to. Backup is the copying. Disaster recovery is the tested plan for running the business again from those copies after a failed server, a fire, a deleted mailbox or ransomware. Together they are often called BCDR, business continuity and disaster recovery.

Data backup services that stop at copying leave the second half undone: a copy is proven only when someone restores it and writes down how long that took.

Office computers and servers: files, shared drives and the software that runs the working day
Cloud mail and documents: Microsoft 365 mailboxes, OneDrive and SharePoint, or Google Workspace
Websites and their databases: the site, its content and the database behind it
Accounting, practice and booking systems: the data and the settings needed to bring them back

The 3-2-1 backup rule, and the offline copy ransomware cannot reach

The 3-2-1 backup rule means keeping three copies of your information, the original and two backups, on two different types of storage, with one copy off-site. The Canadian Centre for Cyber Security recommends it and adds that a backup should be stored offline.¹

For ransomware, the offline copy is the one that counts. The Cyber Centre’s ransomware playbook recommends two or more backups stored offline, out of reach of your networks and internet connection, a secondary copy in the cloud, encryption, and restore tests on a regular schedule.²

The 3-2-1 rule and the Cyber Centre’s additions, in office terms
Rule	What it means for an office	Source
3 copies	The original data and two backups	¹
2 types of storage	For example, a disk in the office and a cloud service	¹
1 copy off-site	One copy kept away from the office, so a fire or a break-in cannot take all three	¹
Offline copies	Two or more backups unreachable from the network and the internet	²
Encryption	Backups encrypted, so a lost disk stays unreadable to whoever finds it	²
Regular tests	A restore test on a schedule; the Cyber Centre gives monthly as an example	²

The 3-2-1 rule with an offline copy, proven by a timed restore and repeated on schedule.

Ransomware protection for small business starts with the copies

Ransomware protection for a small business rests on one fact: if a clean copy of the data survives, the business can be rebuilt without paying. The Cyber Centre notes that offline backups may spare you the need to pay a ransom, and warns that backups do nothing against data theft.¹

A backup drive that stays plugged in, or a cloud backup that opens with the same administrator password as everything else, is within reach of the same attack. We check whether the copies sit under a separate account with its own multi-factor authentication, whether at least one copy is offline or immutable, and whether anyone would notice a backup job that quietly stopped.

Immutable backup is storage that cannot be altered, deleted or overwritten for a set period, the definition Microsoft uses in its own documentation.³ It works alongside the offline copy; where your systems allow, we aim for both.

Microsoft 365 backup: what Microsoft keeps and what stays with you

Microsoft 365 replicates your mail and files across its own data centres to keep the service running, and offers a backup you can roll back to after ransomware or a mass deletion as a separate product. Microsoft 365 Backup is a pay-as-you-go service, billed on the data protected, for SharePoint sites, OneDrive accounts and Exchange mailboxes, with a recovery window you choose of up to two years.³

Retention and deletion policies stay separate from that backup window, Microsoft notes.³ The Cyber Centre’s advice holds for any cloud service: your organization remains responsible for protecting its data.¹ We look at what your Microsoft or Google tenant has today and close the gap with the platform’s own backup, a second copy elsewhere, or both, as your recovery targets require.

RTO and RPO in plain words

RTO and RPO are the two numbers that turn backups into a recovery plan. The recovery time objective is how long a system can stay down before it hurts the business.⁴ The recovery point objective is the point in time your data must be brought back to, which tells you how much recent work you can afford to lose.⁵

You set the targets; we measure what your current backups deliver and show the gap in hours. Restore times in the plan come from the test, so they are numbers we have watched happen, set after the measurement.

The questions behind RTO and RPO for a small office
System	RTO: how long can it be down?	RPO: how much can be lost?
Email	Can the office get through a morning without mail?	Are a few hours of messages acceptable to lose?
Accounting	Can invoicing wait until tomorrow?	Is last night’s copy recent enough?
Website	How long can the site stay offline?	Can a day of orders or bookings be entered again by hand?
Shared files	Which folders are needed first?	An hour of edits, or ten minutes?

How we test a restore and write the recovery plan

A restore test is the proof that a backup works: real data brought back to a separate place, timed and opened. The Cyber Centre asks organizations to test the process of recovering from backup on a routine basis.¹ Our work runs in four steps, each with a written result.

1. Inventory

What is copied, how often, where to and under which account. Gaps are listed in plain words: the laptop nobody backs up, the mailbox left out of the policy, the website copy stored on the same server as the website.

2. Separation

Copies moved away from the main network and the everyday accounts, with their own multi-factor authentication, and one copy offline or immutable.

3. Timed restore

A file, a mailbox and a whole system restored to a test location. We record the date, what came back, how long it took and anything that failed.

4. Recovery plan

Who decides, who calls whom, which system comes back first and from which copy, written for the person who will read it on a bad day.

What you have in hand

At the end you have backups that work, dated proof that they work and a plan your team can follow without us in the room.

A diagram of your backups: what is copied, where, how often and under which account
A tested restore with its date, what was restored and how long it took
A recovery plan in plain words for a failed server, a lost office or ransomware
Missing backups set up and checked, when the scope includes fixing as well as checking
A date for the next restore test

Why a contracted team: the risks of handling backups alone, with a chatbot or a freelancer

Backups handled alone tend to fail quietly. The job reports success while copying an empty folder, the disk fills up, the cloud copy shares a password with the server, and the gap shows only on the day of the restore.

A chatbot can explain the 3-2-1 rule. It cannot see that your accounting data sits outside every folder being copied, and it will be absent on the day the restore has to run.

A freelancer may set up sound copies and move on to the next client. The test schedule, the separate accounts and the plan need someone who stays answerable under a signed agreement.

A contracted team signs a scope letter, writes down what was tested and when, and puts the next test date in the plan.

Five plain reasons to trust us with this

A registered Canadian company
INNOVA CONSULT LTD., federal corporation 1522612-1, based in Ottawa. itopsi is its brand.
In practice since 2013
The group behind itopsi has run legal and marketing practices since 2013. Its founder has worked in law and compliance for more than 14 years.
We run servers of our own
Our own servers and more than 80 websites are checked for known vulnerabilities every day.
Insured
Commercial general liability insurance of CAD 1 million is in force.
Your scope, your report
A fixed scope in a signed letter before any work starts. Licences and equipment at cost, with no vendor commission. The report belongs to you.

How the work goes

Five steps, in the same order every time.

Before any test, you sign a scope letter: what we test, on which dates, who to call, and what we must leave alone.

Your signature comes first

Step 1

We agree what to check

A short call, or the form at the foot of this page. Together we decide which website, server or office systems we look at.

Step 2

You sign the scope letter

It sets the targets, the dates, the contacts, and what we must leave alone. Work starts only once it is signed.

Step 3

We check, and write it down

One report in plain words for you, with the technical detail attached for whoever looks after your systems.

Step 4

We fix it

We make the repairs ourselves, or together with your current IT provider or web developer.

Step 5

We check again

A second check confirms that each problem is closed.

What it costs

Each job is a different size, so each one gets a fixed quote once the scope is agreed. You see the price in writing before any work starts.

Ask for a quote →

A fixed quote once the scope is agreed
The price in writing before work starts
A second check after the fixes

Questions

Questions owners ask us

Your question is missing? Leave your number and ask it in your own words.

Ask on a call

How do we know our backups actually work?

A restore proves it: real data brought back to a separate place, opened and checked, with the time it took written down. The Canadian Centre for Cyber Security asks organizations to test recovery from backup on a routine basis. When the last restore test at your office is more than a few months old, or unknown, a timed test is the first thing we do, and its result goes into a short dated note.

What is the 3-2-1 backup rule?

Three copies of your information, meaning the original and two backups, kept on two different types of storage, with one copy off-site. The Canadian Centre for Cyber Security recommends the rule and also advises keeping a backup offline. For ransomware its playbook goes further: two or more offline backups that the network and the internet cannot reach, encrypted and tested on a regular schedule.

Does Microsoft 365 back up our data by itself?

Microsoft replicates your data to keep the service running, and it sells Microsoft 365 Backup as a separate pay-as-you-go product for SharePoint, OneDrive and Exchange. Retention policies and recycle bins work separately from that backup. The Canadian Centre for Cyber Security reminds organizations that they stay responsible for protecting their data in any cloud service, so the backup you need depends on how much you can afford to lose.

What are RTO and RPO in plain words?

The recovery time objective, RTO, is how long a system can stay down before it starts to hurt the business. The recovery point objective, RPO, is the moment your data has to be brought back to, which sets how much recent work you could lose. Both come from NIST definitions. You choose the targets for each system; a timed restore test shows whether your backups meet them.

Will backups protect us from ransomware?

Backups protect you from losing your data to ransomware, provided at least one copy is offline or immutable and was tested. The Canadian Centre for Cyber Security says offline backups may spare you the need to pay. Backups do nothing about data the attackers copied before encrypting it, which is why recovery is paired with incident response and with fixing the way the attackers got in.

How often should backups be tested?

On a regular schedule that you write into the plan. The Canadian Centre for Cyber Security asks for routine tests of recovery from backup and gives monthly as an example in its ransomware playbook. We usually pair a quick monthly check of the backup jobs with a full timed restore of the most important system at an interval matched to how often that system changes.

How much do backup and disaster recovery services cost?

The price depends on how many computers, servers, mailboxes and websites need copies, how much data there is, how fast each system has to come back, and whether we only check your backups or also set up what is missing. After a 30-minute conversation we put a fixed price for the agreed scope in a scope letter. Storage and licences are passed on at cost.

Tell us what worries you.

Leave your name and a number. A person here calls you back the same business day, usually within an hour, and asks what you want checked. Would you rather start on your own? The free audit takes about three minutes.

Book the free audit instead

Same day callback
Written permission first
Fixed quote