Managed Backup Services: What's Included, Pricing Models and the RPO/RTO Questions to Ask (Hong Kong & Singapore, 2026)

Short answer: Managed backup services hand the design, daily monitoring and regular restore testing of your backups to a provider, under a written scope and service level. A good contract names every system protected, the RPO (how much data you can afford to lose) and RTO (how long you can afford to be down) for each, where the copies sit and who can delete them, how often restores are tested, and what you receive each month as proof. Providers price it per device, per protected terabyte, per user or workload, as a fixed retainer, or as an add-on to a Managed IT plan, and the software licence and cloud storage are often separate lines. Ask for all of them before you compare totals.

What are managed backup services?

A managed backup service is backup run as an outsourced function. The provider designs the backup policy around your systems, deploys and configures the software, watches every job, fixes failures, keeps the copies in the places the policy says, and proves at regular intervals that the data can actually be restored. You keep ownership of the data and the decisions about what matters most; the provider carries the daily work and the evidence.

That differs from buying backup software, where the same tasks fall to your own staff, and from cloud file sync, which copies changes (including deletions and encrypted files) rather than keeping independent restore points. If you are still deciding between running the software yourself and handing it over, read managed backup service vs backup software first. This guide assumes you have decided to buy a service and need to know what a good one includes, how it is priced and what to ask.

It is written for an IT lead or finance lead at a firm of roughly 20 to 300 staff in Hong Kong or Singapore, with a mix of Microsoft 365, a file server or NAS, one or two line-of-business applications and a fleet of laptops.

What should a managed backup service include?

Use this list when you read a proposal. Every item should either be described or explicitly excluded. Anything missing is something you will discover during your first real restore.

• Discovery and scope. A written list of every protected system: servers, virtual machines, NAS shares, databases, Microsoft 365 mailboxes, OneDrive and SharePoint, cloud workloads and, if agreed, endpoints. A system that is not on the list is not backed up.
• Policy design against RPO and RTO. Backup frequency, retention and copy locations set per system, from the recovery objectives you agree, and written down.
• Job monitoring with a named response. Who watches the jobs, during which hours, and what happens when one fails: retry, investigation, ticket, notification to you.
• Offsite and isolated copies. At least one copy away from the primary site and at least one that an attacker using a stolen administrator login cannot delete or encrypt. Ask which is which.
• Encryption and access control. Encryption in transit and at rest, and a short list of people and service accounts that can reach the backup console.
• Restore testing with evidence. Scheduled test restores, at a stated frequency, with results recorded, not just green ticks on job status.
• Restores on request. How you ask for a file, mailbox or server to be restored, and how quickly the provider starts.
• Reporting. A monthly report you can hand to management or an auditor.
• Business continuity documentation. The backup and recovery method written into a plan, so the knowledge does not live in one engineer's head.
• Exit terms. How your backup data is returned or handed over if you change provider, and in what format.

Brocent's cloud managed backup service is built around the same elements: policy design to your RPO and RTO, 24×7 monitoring of backup jobs, offsite storage, recovery drills with a drill report and business continuity plan documentation, across on-premise servers and cloud platforms.

What are RPO and RTO, and how should you set them?

RPO and RTO are the two numbers every backup decision should start from. NIST's contingency planning guide defines the recovery point objective as the point in time to which data must be recovered after an outage, and the recovery time objective as the overall length of time a system can be in the recovery phase before it harms the organisation's mission or business processes.

In plain terms: RPO is how much recent work you can afford to redo, and RTO is how long you can afford to wait. An RPO of 24 hours means a nightly backup is enough; an RPO of one hour needs hourly or continuous protection. An RTO of four hours means the restore method, the hardware to restore onto and the runbook all have to be ready before the incident, not found during it.

How do you set RPO and RTO per system?

Do not set one RPO and RTO for the whole company. Rank systems by what an outage costs, then set the objectives tier by tier. An illustrative example for a 60-person professional services firm (not a client):

• Tier 1, the systems that stop revenue. Accounting or ERP, the practice-management or trading application, email. Tight RPO measured in hours, RTO within the working day.
• Tier 2, shared work in progress. File shares, SharePoint sites, OneDrive. RPO of a few hours to a day, RTO of one working day.
• Tier 3, reference and archive data. Closed matters, old projects, scanned records. RPO of a day or more, RTO of several days is usually acceptable.

The tighter the objective, the more it costs: more frequent jobs, faster storage, more copies and more frequent testing. That is why the tiers belong in the contract. A single headline figure applied to everything is either overpaying for archives or under-protecting the ledger.

Which RPO and RTO questions should you ask a provider?

• For each tier, what backup frequency and retention will you configure, and how does that meet the RPO we agreed?
• How did you calculate the RTO? Have you restored a system of this size, from this storage, at this bandwidth?
• Where do we restore to if the original server is destroyed: spare hardware, a cloud virtual machine, or a replacement we have to buy first?
• Is the RTO measured to "data restored" or to "users working again"? Applications often need configuration and testing after the files are back.
• How often do you test a full restore of a Tier 1 system, and will we see the timed result?
• What happens to the RPO when a job fails overnight: who notices, by when, and is the gap reported to us?
• Which copy would you restore from after ransomware, and can that copy be deleted with the same credentials as production?
• Does the RPO for Microsoft 365 data differ from the one for on-premise servers?

A provider that answers these with specifics has thought about your recovery. One that answers with a brand of software has not.

How are managed backup services priced?

There are five common models, and many proposals combine two of them. Compare the model before you compare the number.

• Per device or per server. A fixed monthly fee for each protected machine. Easy to budget and to audit, but check whether a large database server costs the same as a laptop, and whether storage is included.
• Per protected terabyte. The fee follows data volume. It scales precisely, but grows every month as data grows, and is hard to forecast for a firm that keeps everything.
• Per user or per workload. Common for Microsoft 365 backup, where mailbox, OneDrive and SharePoint data are covered per licensed user. Predictable, but check how shared mailboxes and departed users are counted.
• Fixed monthly retainer. One fee for a defined scope, often with a set number of restore requests or drill hours. Works for stable environments; ask what happens when the scope changes.
• Add-on to a Managed IT plan. Backup priced per device as part of a wider support plan, using the same help desk, monitoring and reporting.

What line items should a backup quote show?

Whatever the model, a complete quote separates these lines. If a line is missing, ask whether it is included or simply not mentioned:

• The service fee (design, monitoring, failure handling, reporting).
• Backup software licences, if they are not bundled.
• Cloud storage, including what happens when you exceed the included amount.
• One-time setup and initial seeding of the first full backup.
• Restore requests and recovery drills: included, capped or charged.
• Any hardware such as a local backup appliance or NAS.

What does Brocent publish?

Brocent sells backup in three ways and publishes the parts it can. For clients on a Managed IT plan, "Cloud Backup — per Device" is a plan add-on priced per market for Hong Kong, Singapore and mainland China; the current rate is shown in the quote tool on the homepage when you select it, and storage beyond the included quota is quoted separately. Licence prices for the backup software behind the service (MSP360, Veeam and Acronis) are listed on the backup and recovery pricing page. The managed service plans for server and hybrid environments are described on the cloud managed backup page. Prices are not repeated in this article so that they cannot drift from the pages that hold them.

Does Microsoft 365 need its own backup?

Microsoft 365 has strong recovery features, and they are worth knowing precisely, because they are not the same as an independent backup.

• Recycle bins. For work or school accounts, deleted OneDrive and SharePoint items stay in the first- and second-stage recycle bins for a total of 93 days by default.
• Restore OneDrive. A user or administrator can roll an entire OneDrive back to a previous point within the last 30 days, which Microsoft positions for cases such as mass deletion, corruption or malware.
• Sync is not a copy. Desktop folders redirected to OneDrive (Known Folder Move) are protected against a lost laptop, but a deletion or an encrypted file on the laptop is synchronised to the cloud as well.

Those windows suit day-to-day mistakes. They do not give you a copy held outside the tenant, retention longer than the window, or protection if an administrator account is compromised. That is the gap a managed Microsoft 365 backup fills. If your staff do not yet have their Desktop and Documents folders in OneDrive at all, start there: our guide to backing up PC folders to OneDrive automatically walks through Known Folder Move step by step.

What evidence should a provider show you every month?

A backup you have never seen restored is a hope, not a control. Ask for a monthly report that answers four questions: did every protected system back up, did the objectives hold, did a restore test succeed, and are the copies still where the policy says.

Brocent's backup and recovery report sample shows what that looks like in practice: protected workloads by system, job success rates with first-attempt and effective figures, RPO and RTO attainment, the result of the period's restore tests, and the status of immutable and offsite copies. It also shows findings carried into the next month, for example a backup set that an administrator could still delete, or an application with no documented recovery steps. Those findings are the point. A report with nothing in it but green status is either describing a very simple estate or not looking hard enough.

What changes for Hong Kong and Singapore firms?

• Personal data law. In Hong Kong, the Personal Data (Privacy) Ordinance; in Singapore, the Personal Data Protection Act. A documented backup policy with access control, encryption and tested restores helps meet the security obligations these laws place on organisations. It does not make you compliant on its own, and no provider can promise that.
• Where the copies sit. Decide which country or cloud region holds your backup copies before the provider does. Some firms want copies outside the city as a disaster precaution; others have client contracts that limit where data may be stored.
• Regulated industries. Financial services firms in both markets often face specific expectations on recovery objectives and testing from their regulators or clients. Put those requirements into the tiers above rather than treating them as a separate project.
• Who comes on site. Restoring a failed server sometimes means hardware work in the office. Ask whether the provider has engineers in each city where you have servers.

What are the red flags in a managed backup proposal?

• One RPO and RTO for every system, with no tiers.
• No mention of restore testing, or testing "on request".
• Every copy reachable with the same administrator login.
• Storage "included" with no stated quota or overage terms.
• Microsoft 365 described as "already backed up by Microsoft".
• A report that only shows job status, with no restore results.
• No answer on how your data is returned if you leave.

Frequently asked questions

What is included in managed backup services?

Design of the backup policy to your RPO and RTO, deployment and configuration, daily monitoring of jobs with failure handling, offsite and isolated copies, encryption and access control, scheduled restore tests with recorded results, restores on request, monthly reporting and documentation of the recovery method. The contract should list every protected system.

How much do managed backup services cost?

It depends on the pricing model and the scope: per device, per protected terabyte, per user or workload, a fixed retainer, or a plan add-on. Ask for the service fee, software licences, cloud storage, setup, and restore or drill charges as separate lines. Brocent's per-device plan add-on rate is shown in its quote tool, and backup software licence prices are on the backup and recovery pricing page.

What is a good RPO and RTO for a small business?

There is no single good number. Set them per system: hours for the accounting system and email, about a working day for shared files, longer for archives. Then check that the backup frequency and restore method can actually meet them.

How often should backups be restore-tested?

Often enough that a failure is found before you need the backup. A common pattern is file-level restore checks every month and a full test of the most critical systems at least every quarter, with timed results kept as evidence.

Is cloud backup the same as managed backup?

No. Cloud backup describes where the copy is stored. Managed backup describes who designs, watches and tests it. You can have cloud backup that nobody monitors, and managed backup that keeps copies on site as well as in the cloud.

Can a managed backup service protect Microsoft 365?

Yes, if it is in scope. Microsoft's recycle bins and OneDrive restore cover recent mistakes within fixed windows; a managed backup keeps an independent copy with the retention you choose and includes it in restore tests and reporting.

Do I still need an on-site backup copy?

Often, yes, for fast restores of large servers, where downloading terabytes from the cloud would exceed your RTO. Hybrid designs keep a local copy for speed and a cloud copy for disasters.

Next steps

Write down your systems, rank them into tiers and set an RPO and RTO for each before you ask for quotes. Then ask every provider for the same line items and the same restore-test evidence. To see how Brocent would scope it, read the cloud managed backup service, add backup to a Managed IT plan in the quote tool, or talk to a Brocent consultant about a server or hybrid environment.