Modern ransomware crews hunt for backup consoles, delete snapshots and steal admin credentials before they encrypt anything. I assess and harden your data protection platform so that when everything else fails, your recovery still works.
Who can log in to your backup platform, and how. MFA on every console, role-based access with least privilege, separate admin identities that are not in your production directory, and break-glass accounts that actually work.
Immutable storage, retention locks and air-gapped or logically isolated copies — verified so that a compromised admin account cannot shorten retention or delete them.
Tested restores into an isolated clean environment, so you know how long recovery takes, what order systems come back in, and whether the data you restore is clean.
Anomaly detection, malware scanning of backup copies and alerting on unusual deletion or encryption activity — so the backup platform becomes an early-warning system.
Supported versions, security advisories, hardened media agents and storage, encrypted data in transit and at rest, and secure key management.
Clear, rehearsed cyber recovery runbooks: who decides, who restores what, where you recover to, and how you prove the restored environment is safe to bring back online.
Findings are mapped to recognised controls, so the report drops straight into your risk register and audit evidence.
Regular backups, restricting administrative privileges and multi-factor authentication — the three Essential Eight strategies that sit directly on your backup platform.
Protect, Detect, Respond and Recover functions, with particular focus on recovery planning and testing.
Annex A controls for information backup, redundancy, access control and ICT readiness for business continuity.
Control 11 (Data Recovery) and the access-control and audit-log controls that protect it.
Find out with a ransomware attack-path and recovery assessment of your backup environment.