Managed Backup Services vs Backup Software: Cost, RPO/RTO & What's Included

Short answer: Backup software copies your files. A managed backup service adds the parts that make a restore dependable: someone watching every job, an offsite copy that ransomware cannot reach, a restore test on a schedule and a written recovery time and recovery point. For large design or CAD data, restore time and bandwidth decide the choice, not storage price.

What is a managed backup service?

A managed backup service is backup run for you as an outcome rather than sold to you as a tool. The provider designs the backup, runs it, watches every job, proves it can be restored and reports back. Brocent's Cloud Managed Backup service is built this way: a preventive backup maintenance plan with 24 × 7 monitoring of all backup jobs by its SCC and NOC teams, a business contingency plan aligned to your recovery targets, and periodical recovery drills that produce a drill report.

Backup software is the engine inside that service, and it can also be bought on its own. The difference is who is accountable when the restore is needed. With software, that is your own IT person. With a managed service, it is a named provider with a written commitment. Software prices are listed on the backup and recovery pricing page.

Managed backup service vs backup software vs cloud sync

Most small and mid-sized offices in Hong Kong end up with one of three arrangements. They look similar on a quote and behave very differently on the day you need a file back.

Three ways to protect the same data

• Backup software you run. You buy a licence, configure jobs and keep the offsite target. It is capable and flexible, but a person on your side must read job results, run restore tests and renew the tooling. In a team where IT is one or two people, the restore tests are the first thing to slip.
• Managed backup service. A provider owns the design, the daily monitoring, the offsite copy, the restore drills and the reporting, using tools such as Veeam, MSP360, Azure Backup or Acronis. You decide your recovery targets; the provider holds the work of meeting them.
• Cloud sync only. OneDrive, SharePoint, Dropbox and similar tools replicate changes. That is useful for collaboration, but a deleted or encrypted file is replicated just as faithfully. Sync is not a backup unless it keeps versions for a defined period and you can restore from them.

If you are choosing between outsourcing and building the skills yourself, how to choose a managed IT services provider in Hong Kong covers the wider decision.

What does "managed" add to a backup?

Five things turn a backup schedule into something you can rely on:

• Monitoring and alerting. Someone reads the job result every day and acts on a failure. The most common backup failure is a job that stops quietly and is noticed only during an incident.
• An offsite, protected copy. At least one copy lives away from your office network and cannot be changed by whoever controls your servers. Brocent's managed IT plans list "Backup / DR (incl. immutable)" in every plan tier, meaning a copy that cannot be altered once written during its retention period.
• Restore tests on a schedule. A restore drill with a dated result shows that the data comes back and how long it takes.
• Written recovery targets. A recovery time objective (RTO) says how long you can be without the data. A recovery point objective (RPO) says how much recent work you can afford to lose. They should be in the agreement, not assumed.
• Reporting. A monthly view of job success, restore tests and open risks, so you can show an auditor or an insurer evidence rather than reassurance.

How long does it take to restore large files?

This is where design practices, architects, media teams and engineering firms get surprised. Restoring 18 TB from the cloud is a bandwidth problem. The arithmetic below uses stated assumptions so you can substitute your own numbers.

Restore-time arithmetic

Assumptions: decimal units (1 TB = 8 × 10¹² bits), the full line speed is available for the restore, and real throughput reaches 70% of the line rate after protocol overhead.

• 1 TB over a 500 Mbps line. At full rate: 8 × 10¹² ÷ 500 × 10⁶ = 16,000 seconds, about 4.4 hours. At 70%: about 6.3 hours.
• 18 TB over a 1 Gbps line. At full rate: 144 × 10¹² ÷ 10⁹ = 144,000 seconds, about 40 hours. At 70%: about 57 hours, or more than two days.
• Restoring only what is needed. If the client wants one project folder of 200 GB, the same line restores it in roughly 40 minutes at 70% of 1 Gbps. A good plan restores the folder first, not the whole NAS.

Three design choices change these numbers. Keeping a local copy on a separate device means a routine restore never touches the internet. Seeding the first full copy to the cloud with a physical transfer avoids weeks of initial upload on a business line. And restoring in priority order, starting with live projects, means people can work while the rest returns. Brocent's service supports local-plus-cloud hybrid designs for exactly this reason, and its differential synchronisation sends only changed data after the first copy.

Is Microsoft 365 backed up by Microsoft?

Not in the way many offices assume. Microsoft keeps its service available and replicates data across its infrastructure, which protects you if their hardware fails. It does not by default protect you from a user deleting a mailbox, an administrator error, a malicious insider or ransomware that syncs encrypted files into SharePoint. Under the shared responsibility model, recovering from those events is the customer's job, so a Microsoft 365 backup is a separate line on a managed backup quote. See the backup and disaster recovery work for Singapore companies for a worked example of why monitoring and restore drills matter.

What does 3-2-1 look like in a small office?

The 3-2-1 rule means three copies of your data, on two different kinds of storage, with one copy offsite. In a 45-person office with a NAS it usually looks like this:

• Copy 1: the live data on the NAS or file server.
• Copy 2: a second device in the office, such as another NAS or a backup appliance, for fast everyday restores.
• Copy 3: an encrypted offsite copy in the cloud, on a platform such as Azure, AWS or Alicloud, kept independent of the primary environment.

Brocent's service describes four patterns (three hybrid and one cloud-only), from local full backup with a cloud copy of the critical data, to a design where the whole on-premise backup is replicated one-to-one to offsite cloud storage. Choose by what your recovery targets require. For the continuity side of the same problem, read IT disaster recovery for a Hong Kong brokerage.

Which cost lines should you compare?

Quotes for backup rarely line up, because each provider groups costs differently. Ask for each of these as a separate line:

• Design and set-up. Planning the jobs, targets and retention, and the first full copy.
• Supervised operation. The monitoring, alerting and reporting you pay for every month.
• Per-device or per-server rates. Endpoint and server coverage is normally priced per device.
• Storage. The amount included, and the rate beyond it. Large design data can pass the included quota quickly.
• Restore tests and drills. Included, or charged per drill?
• Software licences. Bundled in the service, or bought and renewed by you? Vendor list prices are on the backup and recovery pricing page.
• Restore events. Whether a real restore is included or charged.

Because backup and disaster recovery is part of every Brocent managed IT plan, ask what the plan already covers before you buy a separate backup service. The current published figures for the Cloud Managed Backup plan are on the service page.

How do you choose a managed backup provider?

Use these eight questions to compare proposals:

• Scope. Does the quote cover servers, the NAS, laptops and Microsoft 365, and which of them are excluded?
• Monitoring. Who reads the job results, how often and with what alerting?
• Offsite copy. Where does it live, is it encrypted and is any copy unalterable during retention?
• Restore evidence. How often are restores tested, and do you receive a dated report?
• Recovery targets. Are the RTO and RPO written into the agreement?
• Large-file plan. What is the restore time for your biggest dataset on your actual line?
• Keeping your hardware. Can the provider work with the NAS you already own?
• Exit. If you leave, can you take your backup data and documentation with you?

How long should you keep backups?

Retention is a business and legal decision, and it affects the cost of storage directly. Three questions set it:

• How far back does a realistic request go? A design practice may be asked for drawings from several years ago. A trading firm may be asked for last month's email. Write down the longest realistic look-back for each data type.
• What do you have to keep? Accounting and employment records carry statutory retention periods, which are commonly cited as around seven years for accounting records in Hong Kong. Confirm the periods that apply to you with your accountant or legal adviser.
• What should you not keep? Personal data should not be held longer than needed for its purpose, which is a principle of Hong Kong's data protection law. Indefinite retention of everything is not a safe default.

A common pattern is short-term daily copies for quick restores, weekly and monthly copies for a year, and a yearly archive for the longest look-back. Each tier has a different cost and a different restore time, so ask the provider to show the schedule and the storage it implies.

What happens in a ransomware restore?

A backup earns its keep in the worst case. When ransomware encrypts a file server, the restore is not a single click. It follows a sequence, and a managed service should be able to describe each step:

• Contain. Isolate affected machines and accounts so the attack cannot reach the backups or spread further.
• Verify the backup. Confirm that the offsite or unalterable copy is clean and predates the infection.
• Rebuild the platform. Bring up clean servers or a clean NAS to restore onto, rather than restoring onto infected systems.
• Restore in priority order. Start with the systems and projects people need first, then work down the list.
• Check and report. Test that applications and permissions work, document the timeline and record what to change.

The same plan is what your insurer or a client's security questionnaire will ask about. A managed service gives you a written recovery plan and dated test results to show them.

What should a monthly backup report show?

A report that says "all jobs succeeded" is not enough. Ask for these items every month:

• Job success rate by server, device and Microsoft 365 workload, with every failure explained.
• Date and result of the last restore test, including the time it took.
• Protected data volume and growth, so storage costs do not surprise you.
• Retention status, including the oldest recoverable copy.
• Open risks and actions, such as a server not yet covered or a line that is too slow for a full restore.

Warning signs in a backup quote

• "Unlimited" storage with no policy. Large files are exactly where limits appear in the small print.
• No restore test in the scope. If testing is optional, expect it not to happen.
• No named offsite location or encryption statement. You should know where the data lives and how it is protected.
• One copy only. A single backup, even a good one, fails the 3-2-1 rule.
• Price quoted without the data volume. A price per device means nothing if the storage allowance is not stated.

Case study: the 2021 drawings

*This is an illustrative example, not a named client.* A 45-person Hong Kong design practice kept about 18 TB of project data on a NAS, protected by backup software bought three years earlier. A client asked for drawings from 2021. The restore failed because the job had stopped months before, and nobody had been reading its result. The practice moved to a managed service with daily job monitoring, a second local copy for fast restores, an offsite encrypted copy and a quarterly restore drill. It kept its NAS.

Frequently asked questions

What is a managed backup service?

It is a backup arrangement in which a provider designs, runs and monitors your backups, tests restores and reports on the results. You agree the recovery targets, and the provider is responsible for meeting them.

How much does managed backup cost?

It depends on the data volume, the number of devices and servers, the retention period and how often restores are tested. Ask for design, operation, per-device, storage and drill costs as separate lines. Brocent's current figures are on the Cloud Managed Backup page and the pricing page.

Is OneDrive a backup?

Not by itself. OneDrive syncs changes, so a deleted or encrypted file is replicated. It has version history and a recycle bin that help with some mistakes, but it does not replace an independent, tested backup with defined retention.

How often should restores be tested?

At least quarterly for important systems, and after any major change. The test must produce a dated result, including how long the restore took, so you can compare it with your recovery time objective.

How long does it take to restore 1 TB?

Over a 500 Mbps line at 70% efficiency, about 6.3 hours. A local copy shortens that dramatically. See the restore-time arithmetic above for the assumptions.

What is immutable backup?

An immutable backup cannot be changed or deleted during its retention period, even by an administrator account. It protects against ransomware that tries to destroy backups. Brocent lists "Backup / DR (incl. immutable)" in every managed IT plan tier.

Can we keep our NAS?

Usually yes. A NAS can serve as the local copy in a hybrid design, with a protected offsite copy in the cloud. Brocent's service supports Synology, QNAP, NetApp and other NAS or SAN devices as local targets.

Does a managed backup service replace disaster recovery?

No, but it is the foundation of it. Backup protects the data. Disaster recovery covers the people, systems and sequence needed to get the business working again after an outage, a ransomware attack or the loss of an office. A managed backup service should include a written recovery plan with your RTO and RPO, and it should test the restore of your most important systems. Brocent designs and documents this business contingency plan as part of the service.

Do I need a separate backup for Microsoft 365?

In most cases yes. Microsoft keeps its service running, but recovering deleted mailboxes, overwritten files or ransomware-encrypted libraries is your responsibility under the shared responsibility model. Ask whether Microsoft 365 is inside the scope of the quote and how far back you can restore.

Next steps

Read what the service includes on the Cloud Managed Backup page, compare software and plan options on the backup and recovery pricing page, and see how backup fits inside a managed IT plan in the Managed IT Cloud Services overview. For a scoped quote based on your data volume and line speed, talk to a consultant.