Backups you can actually restore.

S4 designs backup systems and continuity plans: we identify critical information and services, agree with you how much data can be lost and how fast you must recover, implement local, offsite and immutable copies and verify them with periodic restores.

Request an assessment

Content reviewed in November 2026

C1Source
C2Backup
C3Storage
C4Recovery

3-2-1 rule with an immutable copy, and scheduled test restores.

Who it is for

IT director

Knowing that recovery works, not assuming it.

General manager

A known time to get back to operating after an incident.

Risk and compliance lead

Documented evidence that critical information can be recovered.

A backup that has never been restored is not a guarantee.

Almost every company has some backup; few know how long it would take to get back to operating. Ransomware, a disk failure or a human error often reveal a backup that is incomplete, old or stored on the same machine it was meant to protect.

You need it if you recognize any of these signs:

The backup is stored on the same server or at the same site.
Nobody has tested a restore in recent months.
How much data can be lost has not been defined.
Email and cloud files have no backup of their own.
There is no written plan for when a critical service goes down.

How the system is built.

We start from the 3-2-1 rule (three copies, on two media, one offsite) and add an immutable or offline copy against ransomware. We adapt to your environment (on-premises servers, virtualization or cloud) without depending on a single vendor.

Source

Physical and virtual servers
End-user devices
Email and cloud files

Backup

Backup software with per-service policies
Incremental and full backups

Storage

Local copy for fast recovery
Offsite or cloud copy
Immutable or offline copy

Recovery

Scheduled test restores
Per-service procedures
Continuity plan

Reference layer diagram. Each project specifies it in its technical report.

What is included and what is not.

Included in the service

Inventory of critical information and services
Recovery objectives (RPO and RTO) agreed with you
Local, offsite and immutable backup strategy
Implementation and configuration of the backup software
Documented restore tests
Continuity plan for critical services

Out of scope

Forensic analysis after a security incident
Storage cost of the chosen cloud provider
Continuity of non-technology processes, which can be coordinated with your risk team

Anything out of scope is coordinated with the right party or quoted separately, and is always stated in writing before we start.

How we do it, step by step.

Assessment

Identification of critical information and services, how they are backed up today and the impact of losing them.

DeliverableImpact analysis and current status
Design

RPO and RTO for each service and design of backup, retention and recovery.

DeliverableBackup policy and continuity plan
Integration

Implementation of the software, the local and offsite repositories and the per-service policies.

DeliverableBackup system operational
Commissioning

First full test restore to measure real times against the objectives.

DeliverableRestore test report
Operation and improvement

Supervision of backup jobs, periodic restores and adjustments when systems change.

DeliverableBackup and test reports

Work sequence: each step closes with a written deliverable.

See the full methodology

Reference regulations and standards.

These are the usual references for this type of system. The technical report of each project identifies which ones apply, depending on the use, size and location of the installation.

Regulatory reference, indicative

ISO 22301: Business continuity management systems; reference for the continuity plan.
ISO/IEC 27001: Information security; includes controls on backups.
Law 1581 of 2012 and Decree 1377 of 2013 (Colombian data protection): Backups containing personal data require the same security measures as the original.

What stays in your hands.

Impact analysis
Critical services and the consequences of losing them.
Backup policy
What is backed up, how often, where and for how long.
Continuity plan
Recovery steps per service.
Restore test report
Real times measured in a test.

How we apply it in your sector.

Works better alongside these services.

Data center and equipment roomInfrastructure that hosts the local copy.IT support and maintenanceDaily supervision of the backups.

What people ask us most.

How often is the backup made?

According to how much data each service can afford to lose (the RPO): a critical service may need several backups a day; a read-only one, a daily backup.

What are RPO and RTO?

RPO is how much data can be lost, measured as time since the last backup. RTO is how quickly the service must be working again. Both drive the design.

Are backups tested?

Yes. An untested backup is not a guarantee: test restores are scheduled and documented.

Doesn't the cloud already back up my email and files?

The cloud guarantees the availability of its platform, but recovering what a user deletes or what an attack encrypts has limits. A backup of your own covers that gap.

Does it protect against ransomware?

An immutable or offline copy cannot be encrypted by an attack that reaches the network, so you can always return to a clean point. It is one layer of protection; it does not replace network security.

Let's talk about your project.

Request an assessment

Or call us: +57 314 460 0683 · +34 848 88 04 04