Backup and disaster recovery
Backup and Disaster Recovery for Financial Firms
Tested backups, fast recovery and a written business continuity plan, so a ransomware attack, server failure or office outage does not stop your firm from serving clients.
Tested restores
Microsoft 365 backup
Ransomware recovery
Business continuity plans
Why it matters
Why backup and disaster recovery matter for financial firms
Client records, tax files, trading and account data and years of email are the core of a financial firm. Losing access to them for even a day can mean missed deadlines, unhappy clients and questions from regulators. Ransomware makes the risk worse, because attackers now try to encrypt or delete backups before they demand payment.
FinFortify Inc. provides backup and disaster recovery as part of our managed IT services for financial firms. We back up the systems and data your firm depends on, keep protected copies offsite, test that restores actually work and write down how your firm keeps operating while systems come back, so recovery is a plan rather than a scramble.
What is included
What our backup and disaster recovery services include
Server and workstation backups
Image-level and file-level backups of servers and key workstations, on a schedule that matches how much data your firm can afford to lose.
Microsoft 365 backup
Separate backups of Exchange Online mailboxes, OneDrive, SharePoint and Teams, so deleted or encrypted data can be restored to a point in time.
Protected offsite copies
Backup copies kept offsite and protected from deletion, so ransomware that reaches your network cannot destroy your backups too.
Monitoring and restore testing
Every backup job is monitored, failures are fixed, and restores are tested on a schedule, with results recorded for exams, audits and insurers.
Disaster recovery planning
A written recovery plan that lists your critical systems, who does what, the order systems come back and how staff keep working in the meantime.
Ransomware recovery
If an attack gets through, our managed cybersecurity team helps contain it and we restore clean systems and data from known-good backups.
Regulations
Business continuity requirements for financial firms
Regulators expect financial firms to keep operating, or recover quickly, when systems fail. The details differ by regulator, but the technical side looks much the same:
- FINRA Rule 4370: member firms must keep a written business continuity plan, update it after material changes and review it every year. See our FINRA business continuity plan guide.
- SEC Regulation S-P: covered firms need an incident response program to detect, respond to and recover from unauthorized access to customer information.
- NYDFS Part 500: covered entities need business continuity and disaster recovery plans, and backups protected from unauthorized changes or destruction.
- Banks and credit unions: examiners review business continuity management, including backups, recovery testing and the resilience of key vendors.
- Cyber insurance: carriers ask whether backups are kept separate from the network and whether restores are tested. See our cyber insurance requirements checklist.
We provide the backups, testing records and technical recovery steps your plan relies on. Learn more about our IT compliance services.
How it works
How we build your recovery plan
Step 1
Identify critical systems
We list the systems and data your firm relies on and how long you can operate without each one.
Step 2
Set recovery targets
We agree how much data you could afford to lose and how quickly each system has to come back.
Step 3
Back up and protect
We deploy backups for servers, workstations and Microsoft 365, with protected copies kept offsite.
Step 4
Test and document
We test restores on a schedule, update the written plan and keep the records your compliance program needs.
Warning signs
Signs your backups may not protect your firm
- Nobody has restored a full system or mailbox from backup as a test in the last year
- Microsoft 365 email and files are not backed up separately from Microsoft
- Backup copies can be reached with the same accounts and network as your servers
- No one is alerted when a backup job fails
- There is no written plan for how staff keep working if the office or a key system is unavailable
If any of these sound familiar, request a quote and we will review your current setup.
FAQ
Backup and disaster recovery questions
What is the difference between backup and disaster recovery?
A backup is a copy of your data. Disaster recovery is the plan, tools and people that bring systems and data back and keep the firm working after an outage, cyberattack or disaster, within a time your business can accept.
Does Microsoft back up our Microsoft 365 data?
Microsoft keeps the service running and keeps deleted items for limited periods, but that is not the same as a separate backup. A dedicated Microsoft 365 backup lets you restore mailboxes, files and sites to a point in time after ransomware, a mistake or a departing employee.
How often should we test our backups?
Test restores on a regular schedule and after major changes, such as a new server or a move to the cloud, and keep a record of each test. Regulators, auditors and cyber insurers increasingly ask for that evidence.
Can backups protect us from ransomware?
Yes, when they are kept separate from your network, protected from deletion and tested. Attackers often go after backups first, so protected offsite copies and a practiced recovery plan are essential.
Know your firm can recover
Ask us to review your current backups and recovery plan.
