Cloud backup and disaster recovery, tested before you need it
Cloud backup keeps encrypted, independent copies of your servers, databases and Microsoft 365 or Google Workspace data off site, so you can restore after ransomware, deletion or hardware failure. Arke Technologies in Johannesburg designs, runs and tests backup and disaster recovery for mid-sized and large organisations, public bodies and schools across South Africa.
Sync is not backup: Google Drive, OneDrive and phones
Files in Google Drive or OneDrive survive a failed laptop, but synchronisation copies mistakes too: a deleted folder, an overwritten spreadsheet or files encrypted by ransomware sync to every device. Deleted items stay recoverable only for a limited period, and a departed user's account can take its data with it. Tools built for individuals behave the same way: Google's Backup and Sync app (now Google Drive for desktop), OneDrive backup of the Desktop and Documents folders, Android cloud backup, and cloud backup for photos through Google Photos or iCloud keep things in step, not in history.
A real Google Drive backup or OneDrive backup is cloud-to-cloud: a separate service copies your tenant's data outside Microsoft or Google on a schedule, with its own retention and administrators. That is how we back up Google Drive and Microsoft 365, with restore records you can put in front of an auditor. See Microsoft 365 and Google Workspace.
Designing a backup solution on cloud: the 3-2-1 rule and beyond
Good cloud backup services follow the long-standing 3-2-1 rule, updated for ransomware.
Three copies, two media, one off site. Production data plus two backups, on at least two kinds of storage, with one copy away from the building.- One copy that cannot be changed. Immutable or offline storage that an attacker with administrator rights cannot delete or encrypt: the control that decides whether ransomware is an inconvenience or a crisis.
- Encryption in transit and at rest, with keys you control, and backup software administered through accounts separate from your everyday domain.
- Retention that matches your obligations: daily copies for weeks, and monthly copies for years where finance, HR or learner records require it.
- Local and online backup storage together. A local copy restores quickly; online backup in South African cloud regions survives the loss of the building.
- Monitoring and restore tests: every job checked, failures raised as tickets, and restores tested on a schedule, because a backup nobody has restored is an assumption.
IT disaster recovery planning: what the plan contains
An IT disaster recovery plan (DRP) is the document your team follows when systems are down and people are under pressure. Whatever disaster recovery plan template you start from, a usable disaster recovery procedure plan contains:
- Scope and priorities: every critical system, ranked, with its RPO and RTO agreed by the business.
- Activation criteria: what counts as a disaster, and who may declare one.
- Roles and a contact tree: named people and deputies, with contact details held outside the systems that may fail.
- Recovery procedures: a runbook for each system, in the order its dependencies require.
- Communication: what staff, learners, clients and, where personal information is compromised, the Information Regulator are told, and when.
- Platform and supplier contacts: cloud accounts, connectivity, licences and hardware support.
- Testing and review: the schedule, the last result and the date of the next review.
We write disaster recovery plans with you, or review yours, in workshops with the people who own each process, and keep them current as systems change.
Disaster recovery testing
Untested recovery is a common gap in backup and disaster recovery, and the one an incident exposes first. IT disaster recovery testing comes in five standard types, in rising order of realism and disruption:
- Checklist review: owners confirm that the plan's contacts, systems and procedures are current.
- Tabletop walkthrough: the team talks through a scenario step by step and finds the gaps.
- Simulation: a realistic scenario is played out, including restores into an isolated environment.
- Parallel test: systems are recovered at the DR site while production keeps running, and the results are compared.
- Full interruption test: production is switched to the DR environment for real; used rarely, and only with executive approval.
Restore tests run on the schedule in your SLA, and each result, with the time it took against the RTO, goes into the monthly service review and your audit file.
South African risks: load-shedding, connectivity and the building
Load-shedding and unstable municipal supply can corrupt databases and damage disks when servers lose power without warning, so we size UPS capacity for a clean shutdown and supply the hardware through Server Hub. Fibre breaks and cable theft cut sites off from the cloud; a second link from Fibre Boyz, our connectivity division, keeps backups moving. And buildings flood, burn and are burgled, which is why one copy always leaves the site.
Governance, compliance and procurement
- POPIA. Section 19 requires reasonable technical and organisational measures against the loss or destruction of personal information, and tested backup is one of them. Copies stay in South Africa unless you decide otherwise, avoiding section 72's conditions on transfers abroad. See POPIA compliance.
- King IV, PFMA and MFMA. King IV Principle 12 makes technology and information governance a board responsibility, and the Auditor-General's ICT audits of departments and municipalities include IT service continuity. Plans, restore records and test results are kept ready for the audit file.
- Controls aligned with ISO/IEC 27001, the NIST Cybersecurity Framework and CIS Controls.
- Reporting: a named service lead, change control over every backup policy, and a monthly service review of backup success, restore tests and open risks.
- Procurement: Level 1 B-BBEE contributor with 135% procurement recognition (sworn affidavit available on request); CSD number, SARS tax compliance status and company documents on request; buy through a proposal and purchase order, a quotation or a tender response.
- Continuity and exit: you own the backup data, the encryption keys and the documentation, handed over with the plan and runbooks if you change provider.
What cloud backup costs in South Africa
Last reviewed: September 2026.
The price of cloud backup and disaster recovery depends on:
- the volume of data protected, and how fast it changes;
- how many servers, virtual machines, mailboxes and users are covered;
- retention, and whether immutable or second-region copies are kept;
- recovery targets, because a warm standby costs more than backup and restore;
- restore traffic out of the cloud, which some platforms charge for;
- how often recovery is tested.
We quote after assessing what you hold and how quickly each system must return. Setting up disaster recovery is a quoted project; running backups, monitoring and tests sits in your monthly SLA fee, and cloud cost optimisation keeps the storage bill in check.