managed backup
We ensure business operational resilience with enterprise Managed Backup and Disaster Recovery as a Service (DRaaS) architectures. Our solutions give companies near-instant recovery times to neutralize the impact of ransomware attacks.
Our managed backup service ensures business continuity through tailored, reliable solutions. Ideal for companies that want to protect their data from interruptions or loss, the service secures your IT with custom plans, expert support and advanced technologies, keeping the business running even in critical scenarios.
What the managed backup service is.
It ensures the protection and rapid recovery of company data in case of loss, cyberattack or disaster. It uses advanced infrastructure such as cloud backup and local systems to guarantee business continuity and data security in increasingly complex environments.
Why it matters.
With the rise in cyberattacks and the dependence on data, having a managed backup plan is fundamental. It not only reduces the risk of downtime and financial loss, but also lets companies comply with cybersecurity regulations such as GDPR and NIS2, protecting critical data and reputation.
Benefits of managed backup.
It ensures secure backups, regulatory compliance, protection from ransomware and fast recovery times. It also lets you plan efficient disaster recovery strategies, increasing business resilience and protecting against the risk of unexpected outages.
How does it work?
- We implement the 3-2-1 backup rule: three copies of the data, on two different media, one off-site at a disaster recovery site.
- We encrypt the data: advanced protection against unauthorized access and cyberattacks.
- Immutable backups: prevention of changes or deletions caused by ransomware.
- Proactive monitoring: constant checks on the status and integrity of backups.
Managed Backup and Business Continuity: NIS2 Art. 21 Obligations
Art. 21 of Italian Legislative Decree 138/2024 explicitly requires business continuity and disaster recovery plans (letter c). Fidem’s Managed Backup service turns this obligation into concrete operational architecture:
- Documented RPO and RTO: every client receives a contractual document with Recovery Point Objective and Recovery Time Objective, an essential element of the evidence pack required in ACN inspections.
- Immutable backups (WORM): protection against ransomware encryption with immutable backups meets the obligation to maintain operational availability even during an attack, one of the scenarios explicitly covered by Art. 21.
- 3-2-1 rule: three copies of the data, on two different media, one offsite, an architecture that meets the resilience requirement for information systems and networks.
- Documented restore tests: untested backups are worthless. The service includes periodic restore tests with documented results and a record, proof for the authorities that the BC/DR plan actually works and is not just on paper.
- Encryption and Italian data residency: all data is encrypted in transit and at rest, stored on Italian infrastructure, ensuring GDPR and NIS2 compliance.
Managed Backup is one of the pillars of the NIS2 compliance path. Discover the complete structure of the 4 compliance phases, from Gap Analysis to continuous verification.
Why a backup is not enough
Because almost every company has backups and almost nobody has tested a restore. The question that matters is not “do we back up” but “how long does it take us to get back up and running, and have we ever checked”. In most cases the answer is discovered on the worst day.
The two questions to ask first
- How much work can we afford to lose? It decides how often you copy.
- How long can we afford to be down? It decides how and where you restore.
They are two numbers the company has to state: everything else follows from them, not the other way round.
Why ransomware changes the rules
Because it goes after the backups first. A backup reachable with the same credentials as the systems it protects gets encrypted along with them. You need isolated or immutable copies, and you need to check that they really are, not that the brochure says so.
What it does NOT cover
Backup restores data, it does not prevent the incident nor remove the obligation to notify if personal data was involved: that remains GDPR territory. And restoring without understanding how they got in means restoring them too: first you need the examination (digital forensics). Glossary.
“We lost our data”: what can still be done
It depends on what happened, and the three situations are handled differently.
- Deletion or failure: restore from backup, if it exists and has been tested. It is the best situation.
- Ransomware: first check that the backups were not encrypted too, then restore. Restoring without understanding how they got in often means bringing the attacker back inside as well.
- Data theft: restoring is not enough: if the data left, you need a technical examination and possibly notification to the data protection authority. It is the work of a digital forensic examination.
One thing not to do, in all three cases: keep using the system. Every hour of activity overwrites traces and reduces what can be recovered or proven.
Backup and data recovery are not the same thing
A backup is a copy made beforehand, and restoring it is predictable. Data recovery is extraction from a damaged medium after the fact: expensive, uncertain and a job for a specialist lab. If what you need instead is to prove what happened to the data, it is neither: it is a forensic examination.
Terms in the glossary.