Disaster Recovery Solutions: Recovery Time Is a Number, Not a Promise

Home Solutions

Ask a practice whether it has backups and the answer is always yes. Ask when it last restored a live central model from them, and whether a drafter’s stolen password could delete the backup as well as the project, and the room goes quiet. Disaster recovery solutions for a design firm aren’t a product you buy. They’re two numbers you agree on, a disaster recovery plan that names who does what, and a test you run until the numbers are true.

We’re NexSys, and we design and run disaster recovery solutions tailored to architecture, engineering and construction firms. Michael Grocott, a senior systems engineer, spent two decades on NetApp storage and Veeam at Norman Disney & Young and elsewhere, and Malcolm Brightman leads the development of SIINC, our platform for automated backup of common data environments.

Book a Strategic Review

Call 1300 733 010

RPO and RTO, per system, in the agreement, from a business impact analysis

Recovery point objective (RPO) is how much data loss you can afford, measured in time, and recovery time objective (RTO) is how long you can afford to be down. ISO 22301 defines the RTO as the period following an incident within which a product, service or activity must be resumed, and that’s the definition we write to. Most firms set one pair of numbers for everything. A live Revit central model on a documentation deadline deserves an RPO measured in minutes and an RTO measured in hours. The timesheet system does not, and paying for the same objective across both is how disaster recovery gets expensive without getting better.

So we run a short business impact analysis first, classifying critical systems and business critical data with the directors in the room, then set objectives per class, then design the replication and the restore path to meet them. The numbers go into the agreement, not a footnote in a quarterly report. Miss them, our problem.

Backup and recovery solutions a compromised account can't delete, in a data centre you can name

Hardware failure, system failure, human error, accidental deletion and natural disasters still happen. Cyber attacks and cyber threats are what the tenders ask about, and Synology’s research puts backup data as the first target in 94 per cent of ransomware attacks, because an attacker who can encrypt your project drive and delete your backup in the same session gets paid. The Australian Signals Directorate’s 2024–25 report puts the average self-reported cost of a cybercrime for a medium business at $97,200, up 55 per cent in a year, and the Office of the Australian Information Commissioner recorded 1,205 notifiable data breaches in 2025, the highest number since the scheme began.

The ACSC’s Essential Eight at Maturity Level Two asks for backups that unprivileged accounts can’t modify or delete, that are retained in a secure and resilient manner, and that are tested as part of disaster recovery exercises. We build data protection and continuous data protection to that level from the start, whether the primary data centre is your server room, a cloud environment or our own. Offsite replication and cloud backup to Australian regions, an immutable copy that no credential in your environment can alter, and a restore test on a schedule, of a real project, with the time recorded. Cameron Zad, our Director of Technical Services, has a view some providers would argue with: a backup that hasn’t been restored is a hypothesis, and a practice that has never timed a restore doesn’t have an RTO, it has a hope.

What's different about disaster recovery processes for a design practice

Three things, starting with the central model. Autodesk recommends 100 GB of free disk for Revit temporary files alone, which tells you how much data a single workstation generates that isn’t in the central file, and a restore that brings back the central model but not the worksharing state leaves the team reconciling for a day. We restore the environment, virtual machines, operating system and data files together, not a file.

Second, the common data environment. If your projects run on Autodesk Construction Cloud, BIM 360, Aconex or ProjectWise, the CDE is a cloud service you don’t control, and its recycle bin isn’t a backup. SIINC exists because of that. Third, the archive: certified designs have to be producible years after practical completion, so the archive is immutable, indexed by project, and restorable on its own without rebuilding anything else.

Data residency comes up in nearly every tender now, and the answer has to be specific. The South Australian Cyber Security Framework’s supplier guideline asks providers to state where data is held, including replicas and backups, and the 2024 Western Australian policy requires incident reporting within 24 hours. We keep offsite copies in Australian regions and put the locations in writing.

Restoration testing that would embarrass us if it failed, and a backup plan that minimises downtime

A restore test is only worth running if it can fail, and the recovery procedures are only worth writing if someone follows them under pressure. Ours restore a live project, not a sample folder, to an isolated environment and open it in Revit or Civil 3D with someone from your team watching. We time it against the RTO and check it against the RPO, and the result goes in the quarterly governance report whether it passed or not. Business continuity planning sits alongside the disaster recovery strategy: who calls whom, which projects come back first, what the client is told, written down before the day it’s needed.

A caveat we’d rather state than have you discover. If your practice is five people with a single server and no government clients, you don’t need our full disaster recovery design. You need a tested backup, an immutable copy and someone to time a restore twice a year, and we’ll quote that instead.

How our disaster recovery services are delivered: managed, or as a service alongside your provider

It’s part of the managed service for our clients, and it’s available on its own for firms with another provider or an internal IT team, in which case the split gets written down and your person signs off the recovery time next to ours. Either way the first step is a systems audit that finds what data backup is actually running today, because the answer is usually less than the invoice suggests.

Questions directors ask first

What's the difference between RPO and RTO?

RPO is how much work you can afford to lose, in time: an RPO of one hour means at most an hour of edits gone. RTO is how long you can afford to be down. Both go into our agreements as numbers, per system, and a restore test checks that we can restore data inside them.

Are our backups kept in Australia?

Yes. Offsite copies are held in Australian regions and we state the primary, replica and backup locations in writing, which is what the South Australian and Western Australian supplier frameworks now ask for.

Is cloud based disaster recovery enough on its own?

For most practices, yes, provided the cloud backup is immutable, held in a secondary data centre in Australia, and restored on a schedule. Recovery as a service, where the whole environment can be started in the cloud while the office is rebuilt, is what a multi-office firm with government work usually needs; a single studio needs the tested backup first.

What do legal and regulatory requirements say about our backups?

Regulatory compliance for a consultant is mostly inherited from clients: the Essential Eight through state frameworks, ISO 19650 archive obligations on state infrastructure work, and the Privacy Act for personal data. None prescribe a product. All assume you can restore business data, so the DR solutions we design start from the test, not the licence.