When a ransomware incident occurs, most executives ask how quickly the business can be restored. In my view, there is a more important question to answer before an incident even occurs: which backup can we trust?
Having recent backups does not necessarily mean an organisation is ready to recover. If an attacker has been inside the environment for days or weeks, creating backups along the way, the latest copy may contain the same foothold that caused the incident. Restoring it could return the organisation to where it started.
The Australian Signals Directorate’s Annual Cyber Threat Report 2024–25 shows how difficult that judgement can be. The Australian Cyber Security Centre responded to 138 ransomware incidents that year, with 39 per cent only coming to light after the ACSC contacted the affected organisation. Nearly four in ten victims did not realise an attacker was inside their environment until someone else told them.
If you do not know when an attacker gained access, you cannot be certain which restore points predate the intrusion. That changes the recovery question. It is no longer simply whether you have backups, but whether you can identify a clean copy, prove it can be trusted and restore it within the time the business can tolerate
Most organisations I speak with have backups, yet far fewer have tested whether those backups will meet the business’s expectations on its worst day. Four assumptions recur again and again.
“Our cloud provider takes care of it”
Many customers believe that because their workloads run on Microsoft 365 or Azure, the provider handles backups. Every major cloud provider, including Microsoft, operates under a shared responsibility model. The provider secures and maintains the platform, while the customer remains responsible for protecting its own data against accidental deletion, malicious insiders and ransomware. Microsoft offers native backup options, and third-party platforms can extend them, but someone in the organisation still must own the policy, retention settings and recovery plan.
“We have high availability, so we’re covered”
High availability and replication are designed to keep services running when a site or system fails, and they do so effectively. Where the risk arises is when replication is the only safeguard. Replication without isolated, point-in-time copies can replicate encrypted or corrupted data to the secondary site within minutes, leaving the organisation with two compromised environments. Protection against a cyber event depends on earlier, isolated copies that an attacker can’t reach or alter.
“We back up every night, so we can recover”
A backup that has never been restored is an untested assumption, and I regularly meet organisations that haven’t run a full recovery test in years. Restore testing is the only way to confirm that backups are complete, applications return to a working state, and to determine how long the process really takes. It also needs to happen regularly, because environments change and a recovery plan written three years ago rarely reflects today’s systems.
“We’ll bring everything back”
When a major incident hits, there’s rarely time or capacity to restore everything at once. The organisations that recover well have decided in advance which five to ten applications the business needs first to keep trading, and in what order. That decision rests on two measures that many teams haven’t formally defined. The recovery time objective (RTO) is how long each system can be unavailable before the impact becomes unacceptable, while the recovery point objective (RPO) is how much data, measured in time, the business can afford to lose. Without agreed RTOs and RPOs, recovery becomes a scramble to bring everything back at once, and the systems that matter most can end up waiting in the queue.
In my conversations with customers, the terms “cyber resilience” and “data resilience” are often used interchangeably, blurring an important distinction. Cyber resilience is preventative, covering the monitoring, detection and controls designed to stop an attacker from getting in and to limit what they can do once they’re inside.
Data resilience, on the other hand, covers backup and disaster recovery, and it works after the fact. When something gets through, data resilience is the “break glass in case of emergency” option that gets the business running again.
The two disciplines overlap, determining which backups an attack has affected requires some of the same detection capabilities that protect production systems, and that’s increasingly where modern data protection platforms earn their place. However, treating the two as one thing tends to leave recovery underinvested and untested.
These questions are no longer only internal, as Australian regulation increasingly expects organisations to demonstrate how they can recover and to report on it.
For APRA-regulated entities, Prudential Standard CPS 230 Operational Risk Management has applied in full since 1 July 2026, when the transition period for existing service provider contracts ended. It requires boards to approve tolerance levels for each critical operation, including the maximum disruption period and the extent of data loss the entity would accept. In practice, that’s an RTO and RPO signed off at board level, and the organisation needs to demonstrate it can meet them.
Beyond financial services, the Cyber Security Act 2024 requires businesses with an annual turnover of $3 million or more, as well as responsible entities for critical infrastructure, to report any ransomware or cyber extortion payment within 72 hours1. From January 2026, the Department of Home Affairs began shifting from an education-first approach to an enforcement focus. Reliable recovery is what keeps an organisation from having to consider making a payment at all.
Privacy law is heading in a similar direction. The exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, released on 31 August, proposes strengthening APP 11 so that organisations must take reasonable steps to identify the personal information they hold, actively consider destroying information they no longer need, and regularly evaluate their retention and destruction practices. The Bill is still at the consultation stage, yet it raises a question few organisations have considered. What personal information is sitting in years of backup retention, and could you find it if you had to?
The common thread across all three is evidence. Boards and regulators want to see documented policies, tested results and data held in the right places, and organisations need to be able to produce that reporting quickly.
The organisations I see recover well from cyber incidents share a handful of practices. None is new on its own, yet together they turn backup from an insurance policy nobody has checked into a capability the business can rely on.
Copies that can’t be changed
Once a backup has been written and verified, it shouldn’t be possible to alter it. For example, Dell PowerProtect Data Domain appliances can lock protected copies so they can’t be modified or deleted before their retention period ends, and changes to those protections can require sign-off from more than one authorised person. An attacker who gains administrator credentials still can’t erase the organisation’s way back.
Recovery in a clean room first
Restoring directly to production after a cyber event is a gamble. A clean room approach brings systems back in an isolated environment first, where they can be checked for malware or encryption that caused the incident before they rejoin the business. Dell’s cyber recovery portfolio pairs an isolated vault for critical data with analytics designed to flag signs of ransomware activity, helping teams identify the last known-good copy.
Testing on a schedule
Recovery testing belongs on the calendar and is measured against the RTOs and RPOs the business has agreed. Each test shows whether those targets are realistic and provides the evidence that boards and regulators are starting to ask for.
The 3-2-1 rule, with Australian residency
The 3-2-1 rule is old, but it still holds. Keep at least three copies of your data on two different storage types with one copy off-site. That off-site copy can be in a second data centre or in the cloud, provided it’s in an Australian region where your regulatory obligations require it. Knowing exactly where each copy resides and who can access it is part of the same compliance picture.
Having backups is only part of recovery readiness. The real test is whether you can identify a clean copy, verify that it can be trusted and restore your priority systems within the time the business can tolerate.
Data#3 and Dell Technologies help Australian organisations strengthen their approach to data protection and cyber recovery, from immutable and isolated copies through to recovery testing and prioritisation.
If you cannot confidently identify your last clean backup, that’s where to start. Talk to Data#3 about your recovery readiness and register for the Data Protection Workshop.
Contact our team today.
Information provided within this form will be handled in accordance with our privacy statement.