Cloud Backup for Cyber Resilience

Organizations and society now depend heavily on digital services, making outages and cyber incidents far more damaging—especially in highly optimized, just-in-time public services, manufacturing, and commerce. The text highlights how cyberattacks and cloud outages can quickly disrupt operations and impose major financial and continuity impacts, citing UK incidents in 2025 affecting Marks & Spencer, the Co-op Group, Jaguar Land Rover, and an AWS service outage that limited access to enterprise and government systems. The accelerating adoption of Generative AI increases the cyber risk surface and enables attackers to scale and improve techniques such as phishing, while geopolitical tensions amplify threats from state-backed actors and raise operational continuity concerns tied to digital sovereignty. In response, governments are strengthening resilience requirements through regulations such as EU NIS2 and DORA, and broader obligations such as GDPR Article 32 and SOX emphasize integrity, availability, and resilient processing systems.

Achieving cyber resilience requires going beyond preventative security controls to build robust response and recovery capabilities—particularly the ability to back up, protect, and restore not only business data but also the metadata and configuration elements that define modern virtualized and cloud infrastructure, workloads, and applications. Backup and Disaster Recovery (DR) solutions are described as providing secure creation and storage of backups that support defined Recovery Point Objectives (RPOs) and Recovery Time Objectives (RTOs), along with restoration and service recovery capabilities. Effective solutions address diverse data sources (on-premises, edge, IaaS/PaaS/SaaS), use methods like incremental/continuous backups and replication, support application-aware and snapshot backups for consistency, and protect backup repositories via encryption, malware scanning, air-gapping, immutability, and multi-copy strategies such as the 3-2-1 principle. Because attackers target backup systems and processes, the text stresses hardening backup infrastructure and administrative controls (MFA, least privilege, logging). It also covers advanced recovery needs including cross-platform recovery (e.g., cross-hypervisor, physical-to-virtual, restore into public cloud) and varying DR service models (managed DR, assisted recovery, automation and testing). Finally, it outlines key use cases (cyberattack resilience, data corruption, datacenter and cloud service resilience, migration/lock-in protection), functional selection criteria (security, interoperability, usability, SaaS/IaaS coverage, compliance, ransomware protection, DR capabilities), and practical procurement and architecture considerations, including integrating backup/DR into incident response planning and testing.

• During 2025, cyberattacks in the UK on Marks & Spencer (M&S), the Co-op Group, and Jaguar Land Rover (JLR) caused significant disruption and multi-million-dollar financial costs.
• An AWS service outage in October 2025 led to loss of access to enterprise and government systems in the UK.
• IBM’s Cost of a Data Breach Report is cited as finding that in 2025, one in six data breaches involved AI-driven attacks.
• The same IBM report is cited as stating that 13% of organizations reported a security incident on an AI model or application that resulted in a breach.
• Deleting an S3 Object Storage bucket results in the data being gone and not recoverable (as stated in the text’s example).
• When a customer administrator deletes a user in Entra ID, after 30 days the user and associated Exchange mailbox and OneDrive data are permanently deleted (per the text).
• GDPR Article 32 is described as mandating measures to ensure ongoing confidentiality, integrity, availability, and resilience of processing systems and services.
• The Sarbanes-Oxley Act (SOX) is described as requiring companies to maintain and back up financial records to ensure accuracy and audit availability.
• NIS2 and DORA are described as including specific requirements for data backup and recovery to ensure operational resilience.
• The 3-2-1 backup principle is described as recommending three copies of data, on two media types, with at least one physically separated off-site.

• “To achieve cyber resilience, organizations must take steps beyond implementing security controls to prevent cyber threats from impacting their digital infrastructure; they must also develop the capabilities needed to respond to and recover from incidents.”
• “If an organization is unable to access its data or business applications, this could destroy the entire business.”
• “The race to adopt Generative AI (GenAI) has increased the organizational cyber risk surface and its exploitation by cyber adversaries has accelerated the speed and effectiveness of attack techniques.”
• “Cloud services are now at the core of modern businesses, powering everything from real-time customer engagement to AI-driven analytics.”
• “The responsibility for data held in cloud services is shared between the customer and the Cloud Service Provider (CSP).”
• “In general terms, the cloud customer is always responsible for ensuring that their data is protected from loss and corruption.”
• “This data is a prime target for attackers and solutions provide protection in several ways, including a physical air gap, immutable storage, or multiple copies, for example.”
• “Threat actors actively target the backup processes to disable backup or remove copies.”
• “Usability is particularly critical during recovery scenarios following cyber incidents.”
• “It is essential to ensure that they are fully integrated into the incident response processes.”