Disruption does not book an appointment. A hardware failure, a cyber attack such as ransomware, a fire, a flood, an operator error or an outage can stop operations within minutes. Without a tested way back, the price is extended downtime, data loss, regulatory penalties and customers who do not wait.

A traditional backup solution copies data. THUSA BCDR restores the whole environment. That means systems, applications, verified data integrity and a coordinated recovery sequence. Automated backup, documented procedures, regular testing and 24/7 support sit behind it, and THUSA engineers run the quarterly recovery tests that keep your business continuity plan honest.

A backup that reports success is not a recovery that works.

The Operational Recovery Challenge

Six gaps stay invisible while the backup job keeps reporting success.

Inadequate backup coverage.

File servers are backed up. Databases, email, configurations and specialised applications often are not. Data restored without its dependencies and integrations is not a working application.

Untested recovery procedures.

A green tick is no guarantee of recovery. Failures show up during the real recovery. So do the missing steps and wrong assumptions in procedures nobody has run.

Unacceptable recovery times.

A traditional backup system restores slowly. It takes hours or days to rebuild servers, reinstall operating systems, restore data and check it. Every one of those hours is lost revenue, missed obligations and reputational damage.

Single points of failure.

Backups kept beside production offer no protection from fire, flood, theft or a widespread power failure. Ransomware also goes after the backup system, to remove the recovery option. So ransomware protection has to cover the backups themselves.

No business impact analysis.

Without a recovery time objective (RTO) and a recovery point objective (RPO) for each system, recovery cannot be ranked or resourced. Critical systems end up with the same protection as non-essential ones, or less. A business continuity plan starts here.

Compliance gaps.

THUSA keeps backup retention, encryption, access controls and data residency aligned with POPIA. It documents tested recovery as evidence. Without that evidence, a regulatory review finds little to show.

BCDR in numbers

Each figure carries the scope the service gives it.

24 hours, 4 hours, under 1 hour

Are the recovery targets of the three service tiers.

Minutes

Is the recovery point objective for critical databases and applications under continuous data protection.

30 days and 90 days

Are the retention periods in the first two tiers; across the service, retention runs from 30 days to 7 years.

Quarterly and monthly

Are the recovery test cadences in the first two tiers.

About six weeks

Is the roadmap from first assessment to a first proven restore.

Case studies across sectors and outcomes

See how THUSA's managed IT services work out in practice, or browse all case studies.

“The migration to THUSA's data center was a game-changer for our business. With always-on infrastructure and responsive support, we've eliminated downtime and are now ready for future growth.”

CEO · Major Clothing Retailer in South Africa

Featured case · Retail

Read case

Explore all case studies

Eight disaster recovery layers, from the first backup to the business continuity plan.

Core BCDR Capability Areas

Each layer is described as THUSA delivers it. The tier you choose sets how fast and how far it goes.

Automated backup and recovery Geographically diverse recovery sites Recovery capabilities and Microsoft 365 backup Disaster recovery orchestration Regular testing and validation Ransomware protection Business continuity planning Compliance and regulatory alignment

Automated backup and recovery

Agents capture production systems continuously. They understand the application, not just the files. Every backup is verified before its window closes. These backup solutions are checked, not assumed, and they feed the ransomware protection below, while coverage spans Microsoft SQL, Microsoft 365, Active Directory, Hyper-V and VMware.

Continuous protection: Near real-time capture; recovery point in minutes
Application-aware backup: Consistent snapshots, Exchange mailbox recovery
Incremental forever: Only changed blocks after the first full backup
Verification: Checked as readable, complete and restorable
Platform coverage: Microsoft SQL, Microsoft 365, Active Directory, Hyper-V, VMware

Geographically diverse recovery sites

Backup data leaves the building. It replicates over encrypted links to separate THUSA data centres, ages onto cheaper storage and, for critical backups, sits where nobody can modify or delete it. That is ransomware protection at the storage layer.

Offsite replication: Encrypted copies at separate THUSA data centres
Multi-tier storage: Fast storage for recent backups, capacity storage for older ones
Immutable storage: Critical backups cannot be altered or deleted
Air-gapped copies: Optional, isolated from the network

Recovery capabilities and Microsoft 365 backup

The restore is sized to the incident: a single file, a whole server, or a virtual machine booting from backup storage. Granular application recovery covers Exchange mailbox recovery, SharePoint site recovery, SQL tables and Active Directory objects. None needs a full system restore. THUSA lists Microsoft 365 among the platforms its recovery covers. So Microsoft 365 backup belongs in the same plan as your servers.

File and folder: Self-service restore
Full system: To physical, virtual or cloud hardware
Bare metal: Blank hardware, no operating system rebuild
Instant VM: Boots from backup storage within minutes
Granular application: Exchange mailbox recovery, SharePoint site recovery, SQL tables, Active Directory objects

Disaster recovery orchestration

A documented, automated sequence drives recovery by business criticality, so the right systems come back first whoever is on shift. These disaster recovery runbooks are tested. The business continuity plan tells people what to do while they run.

Disaster recovery runbooks: Dependencies, sequence and rollback documented
Automated workflows: Provisioning to connectivity tests, sequenced
RTO and RPO: Set by system criticality
Recovery order: Tier 1 immediately, Tier 2 within hours, Tier 3 within 24 hours

Regular testing and validation

An unrestored backup is a hope. THUSA restores systems in isolation, exercises the people once a year and reports on both. Disaster recovery testing runs quarterly under BCDR Essentials and monthly under BCDR Advanced, and the annual exercise tests the business continuity plan.

Quarterly tests: Isolated restores, checked, gaps documented
Tabletop exercises: Annual, covering roles and decisions
Reporting: Times achieved, issues found, trends

Ransomware protection

Ransomware goes for the backups first. Detection preserves clean recovery points before encryption finishes, and critical backups are immutable, with optional air-gapped copies that survive stolen credentials. Ransomware protection here has three parts: detection, immutable copies and a rehearsed recovery. The recovery steps involve no ransom payment.

Detection: Backup systems integrate with endpoint security
Immutable and air-gapped: Ransomware cannot encrypt or delete critical backups; air-gapped copies are optional
Ransomware recovery: Isolate, restore from clean points, check; no ransom

Business continuity planning

Technology is only part of it. Business continuity planning puts workshops, written plans and ready communication around the restore, so your business can act while engineers work. A business continuity plan from THUSA starts with a business impact analysis. It ends with a plan people can follow under pressure.

Impact analysis: Critical processes and downtime tolerance
Business continuity plan: Written plan: escalation, communication, roles, vendors
Crisis communication: Ready templates and distribution lists
Vendor continuity: Alternatives and contingency plans

Compliance and regulatory alignment

THUSA keeps the evidence of tested recovery as routine. Test results and the business continuity plan are ready when an audit asks.

POPIA: Retention, encryption, access and residency aligned
ISO 27001 and SOC 2: Evidence supports framework requirements
Audit evidence: Logs, test results and change records kept ready

Choose the tier by how long the business can afford to stand still.

Service Tiers

Each tier is defined by its recovery target. Backup frequency, retention and testing follow from it. The target should match your business continuity plan.

24-hour recovery

BCDR essentials

Standard business systems

Daily backups;
30-day retention;
offsite replication;
file and folder recovery;
quarterly testing

4-hour recovery

BCDR advanced

Business-critical systems

Multiple daily backups;
90-day retention;
instant VM recovery;
application-aware backup, including Exchange mailbox recovery;
monthly testing

Sub-hour recovery

BCDR enterprise

Mission-critical systems with near-zero downtime tolerance

Continuous replication;
extended retention;
hot standby infrastructure;
dedicated recovery orchestration

How often a copy is taken, and how long you wait to be back.

Three tiers, two measures

The tier is chosen per system, by what the business can tolerate losing and how long it can be without it. Not every system needs the top tier.

← scroll the diagram →

From assessment to a first proven restore in about six weeks, then kept ready.

Implementation roadmap

The first recovery test happens before the project closes, not after the first incident.

Assessment and planning

(weeks 1 to 2):
- business impact analysis and RTO and RPO definition;
- current backup assessment and gap analysis;
- recovery strategy development;
- stakeholder alignment
Infrastructure deployment

(weeks 2 to 4):
- backup agent deployment;
- replication configuration;
- recovery environment set-up;
- initial backup run
Testing and validation

(weeks 4 to 6):
- disaster recovery procedure documentation;
- initial recovery testing;
- procedure refinement;
- team training
Ongoing operations:
- automated daily operations;
- quarterly recovery testing;
- annual continuity planning updates;
- continuous improvement

Priced on the data you protect and how quickly you need it back.

Pricing model

Standard disaster recovery to THUSA infrastructure is included. Faster paths are options, not surprises.

Backup storage

Per protected GB per month; retention 30 days to 7 years; performance or capacity storage

Recovery infrastructure

Standard disaster recovery to THUSA infrastructure included; optional dedicated recovery or hot standby

Professional services

Scoped separately: impact analysis and business continuity planning, recovery tests, audit support, ransomware recovery

Five numbers that tell you whether recovery would actually work.

What gets measured

Tracked and reported, so assurance rests on evidence rather than on a green tick.

Backup success rate

Share of scheduled backups that complete

Recovery time achievement

Actual recovery times against RTO targets

Recovery point achievement

Measured data loss against RPO targets

Test success rate

Share of recovery tests that meet their objectives

Compliance status

Audit findings and remediation tracking

If any of these describe your environment, the recovery gap is already open.

Who this is for

Backups that have never been restored.

The backup solution reports success every night. Nobody has proved that a system, a Microsoft 365 mailbox or a SharePoint site comes back from it.

Backup infrastructure beside production.

Fire, flood, theft or a power failure takes both at once. Ransomware takes the backups too.

Ransomware exposure.

Attackers target backup systems first. So you need copies that a holder of administrative credentials cannot encrypt or delete.

Regulated data.

POPIA or an industry framework applies, and the audit evidence does not yet exist.

Systems that cannot be down for a day.

Rebuilding servers and restoring data takes hours or days. The business cannot carry that.

A business continuity plan nobody has rehearsed.

The document exists. The people have never run it.

Start with what you have, and find out whether it comes back.

BCDR assessment.

A complimentary review of current capability: gap analysis, RTO and RPO recommendations and an investment roadmap.

Recovery test.

A supervised recovery test of your current backup solution, to find the gaps and build confidence in the procedures before an incident does.

Phone

087 941 6890

Email

info@thusa.co.za Request a BCDR assessment

FAQ

What is the difference between backup and disaster recovery?

Backup copies your data. Disaster recovery is the tested ability to restore operations from it under pressure. An environment can be backed up, with every job reporting success, and still be unprepared. Recovery procedures may be untested, backup integrity assumed and dependencies undocumented. THUSA BCDR closes that gap with application-aware backup on Veeam, quarterly recovery tests, documented runbooks, ransomware protection and a written business continuity plan.

How quickly can you restore after an outage?

It depends on the tier. You choose the tier by how long the business can afford to stand still. If a day is tolerable, BCDR Essentials targets 24-hour recovery. If it is not, BCDR Advanced targets 4-hour recovery for business-critical systems and adds instant VM recovery, which boots critical workloads within minutes. Where tolerance is near zero, BCDR Enterprise targets sub-hour recovery, and your business continuity plan should name those systems.

Can THUSA do our Office 365 backup, including Exchange and SharePoint?

Yes, BCDR covers Microsoft 365 backup. THUSA's service document lists Microsoft 365 among the platforms its recovery covers, with SQL, Active Directory, Hyper-V and VMware. Granular application recovery gives you Exchange mailbox recovery and SharePoint site recovery. Individual mailboxes and sites are restored without a full system recovery, as are SQL database tables and Active Directory objects. For the service itself, see THUSA's managed Microsoft 365 service.

What goes into a business continuity plan?

A business continuity plan names the critical processes and the technology each one depends on. It states how long the business can be down and how much data it can lose, and adds written playbooks for escalation, communication and recovery roles. THUSA's business continuity planning starts with a business impact analysis, then tests the plan. For the why, see business continuity.

How does ransomware protection work with your backups?

Ransomware protection starts with detection. The backup system integrates with endpoint security, and automatic snapshots preserve clean recovery points before encryption finishes, and critical backups are immutable. Optional air-gapped copies stay available if attackers hold administrative credentials. Ransomware recovery then isolates infected systems, finds a clean recovery point, restores the data and checks it. The recovery steps involve no ransom payment.

Which backup solutions does the service include?

THUSA's backup solutions combine application-aware backup, incremental-forever capture, offsite replication, immutable storage, ransomware recovery, verified restores and coverage that includes Microsoft 365. Veeam is the platform named in THUSA's service document. The three tiers step up. They run from daily backups with 30-day retention, through multiple daily backups with 90-day retention, to continuous replication.

Business Continuity & Disaster Recovery (BCDR)