Mario Leiva, specialist in architecting high-availability data protection frameworks across North America, Australia and Europe
TL:DR: Backup as a service (BaaS) is a subscription model where a provider stores, protects, and tests recovery of an organisation’s data offsite instead of that organisation running its own backup hardware or software. Pricing is usage-based, driven mainly by data volume, retention period, and recovery-testing frequency, with no large upfront hardware cost. In Australia, the criteria that matter most are local data residency, immutable ransomware-resistant storage, compatibility with the backup software already in use, and alignment with frameworks such as the Essential Eight. This guide covers how backup as a service works, what it costs, and what to check before choosing a provider.
Ransomware targets backups specifically: 93 per cent of cyber-attacks now go after backup storage first, to remove an organisation’s ability to recover without paying a ransom. In Australia, the Australian Signals Directorate responded to 138 ransomware incidents in FY2024–25 alone, with average cybercrime costs climbing to AU$56,571 for small businesses and AU$97,166 for medium businesses.
Most of that risk traces back to how backup is actually run day to day. Regular backups are one of the Australian government’s own Essential Eight mitigation strategies, and even inside government, only 67 per cent of entities reached Maturity Level 2 or higher for that single control in FY2024–25. Running backup hardware, tape, or software in-house means an organisation owns every patch cycle, every capacity decision, and every recovery test — and in practice, testing is often the first thing to slip.
Backup as a service moves that operational load to a dedicated managed IT service provider who runs the platform, tests the recovery, and bills on usage instead of upfront hardware spend. This guide covers what backup as a service is, how it works, what it costs, and what to check for in an Australian provider.
Glossary
- Backup as a service (BaaS): A subscription model in which a third-party provider manages backup infrastructure, software, storage, and recovery on an organisation’s behalf, rather than that organisation running and maintaining it itself.
- Disaster recovery as a service (DRaaS): A close relative of BaaS focused on full system failover during an outage, rather than file- or application-level recovery.
- Immutable backup: A backup stored in a format that cannot be altered, encrypted, or deleted once written, even if ransomware compromises the primary environment.
- Recovery time objective (RTO): The maximum acceptable length of time a system can be down before it must be restored.
- Recovery point objective (RPO): The maximum acceptable amount of data loss, measured in time, between the last backup and an outage.
- Air-gapped backup: A backup copy that is physically or logically isolated from the production network, so it cannot be reached by an attacker who has already compromised that network.
- Egress fees: Charges a provider applies when data is moved out of its environment — for example, during a recovery or a migration to a different provider.
- Essential Eight: The Australian Signals Directorate’s baseline set of eight mitigation strategies, including regular backups, that organisations use to reduce the risk and impact of cyber security incidents.
What is backup as a service (BaaS)?
Backup as a service is a subscription model where a third-party provider manages your backup infrastructure, storage, and recovery process instead of you running it in-house.
Instead of running and maintaining backup servers, tape libraries, or software licences, an organisation sends its data to a provider who stores it securely offsite — usually in an immutable, encrypted format — and makes it available for fast recovery when needed. BaaS is sometimes used alongside the term managed backup, and it is a close relative of disaster-recovery-as-a-service, which focuses on full system failover rather than file- and application-level recovery; most providers offer both under one data-protection umbrella.
How does backup as a service work?
In practice, your existing backup software sends data over a private connection to the provider, who stores it offsite in an immutable, regularly tested repository.
Backup as a service follows a similar pattern across providers:
- Existing backup software (commonly Veeam or Commvault) or a lightweight connector sends data to the provider’s platform, often over a direct, private connection rather than the public internet.
- The provider stores that data offsite in an immutable repository, meaning once written, backups cannot be altered or deleted, even if ransomware compromises the primary environment.
- Recovery is tested on a regular, scheduled basis rather than assumed to work, so a bad backup is found during a test, not during an actual outage.
- Billing is usage-based, typically per TB stored, so cost scales with the data footprint rather than requiring upfront hardware spend.
What are the benefits of backup as a service?
Backup as a service removes the cost and upkeep of backup hardware, adds ransomware-resistant immutable storage, and replaces guesswork with regularly tested, verified recovery.
- No backup hardware, tape libraries, or software licences to buy, run, or refresh.
- Immutable, offsite storage that protects backups from ransomware, even if an attack reaches the primary systems.
- Predictable, usage-based pricing instead of large upfront capital spend.
- Faster recovery — lower RTO and RPO — than tape or on-premises-only backup.
- Regular, independently verified recovery testing, useful for audit and compliance requirements.
- Frees up internal IT time for higher-value work.
What does backup as a service cost?
Cost is usage-based, driven mainly by data volume, retention period, and recovery-testing frequency, so cost tracks actual usage rather than a large upfront hardware purchase.
BaaS pricing is usually driven by a handful of factors rather than a flat rate:
- Data volume: most providers charge per TB stored, so cost tracks the actual footprint.
- Retention period: how long backups are kept before they age out affects total storage.
- Recovery and testing frequency: more frequent, more rigorous recovery testing can carry a premium.
- Software compatibility: working with the platform already in use (Veeam, Commvault, Microsoft 365) avoids a costly re-platform.
The advantage over traditional backup is that there is no large upfront hardware purchase. Cost is based on usage, which makes budgeting more predictable and avoids over- or under-provisioning.
What should you look for in a backup as a service provider in Australia?
Look for Australian data residency, immutable storage as standard, compatibility with your existing backup software, scheduled recovery testing, and alignment with frameworks like the Essential Eight.
- Australian data residency, ideally with a local data centre rather than an offshore-only option.
- Immutable, ransomware-resistant storage as standard, not an add-on.
- Compatibility with the backup software already in use (Veeam, Commvault, Microsoft 365 connectors).
- Recovery that is actually tested on a schedule, not just backups that are taken and never verified.
- Alignment with Australian compliance frameworks, including the Essential Eight where relevant to the sector.
- Transparent, usage-based pricing with no surprise egress or recovery fees.
- Clarity on jurisdictional exposure — whether a provider’s ownership structure could expose data to a foreign disclosure law such as the US CLOUD Act, even when the data itself sits in Australia.
Who offers backup as a service in Australia?
Backup as a service in Australia is offered by global hyperscalers, national managed service providers, and Australian-based specialists including ThinkOn, which delivers immutable, ransomware-resistant backup with scheduled recovery testing.
The comparison below sets out the criteria to check regardless of which provider is under consideration.
Comparing backup as a service approaches
| Criteria | DIY / on-premises backup | Generic cloud or hyperscaler backup | ThinkOn backup as a service |
| Data residency | Depends entirely on where hardware is purchased and hosted | Often mirrors to the nearest regional zone; may replicate outside Australia | Perth data centre (P1); Western Australian data stored and managed locally |
| Jurisdictional / CLOUD Act exposure | N/A — data stays wherever the organisation’s own hardware sits | May be subject to foreign disclosure laws (e.g., the CLOUD Act) regardless of where data is physically stored | Canadian-owned and Australian-operated; no US parent or US-headquartered entity in the ownership chain. |
| Immutable storage | Rarely default; usually requires separate configuration | Available but frequently an add-on | Hardened Repository — immutable, ransomware-resistant storage as standard |
| Software compatibility | Whatever the organisation already licenses, unsupported if that changes | Varies by provider; often requires re-platforming | Veeam Cloud Connect, Compass Data Protect (Microsoft 365), and Commvault support |
| Recovery testing | Ad hoc, if it happens at all | Varies by provider | Tested on a scheduled, certified basis |
| Pricing model | Large upfront capital spend on hardware and licences | Usage-based, but egress or recovery fees are common | Usage-based, per TB stored, with no egress fees |
| Compliance framework alignment | Depends entirely on the internal team’s own programme | Varies by provider | Supports alignment with frameworks such as the Essential Eight where relevant to the sector |
Note: the CLOUD Act row uses ThinkOn’s standing approved Australian sovereignty self-description, verbatim, per writer_checklist.docx Section 3.
Key figures at a glance
138 ransomware incidents were responded to by the Australian Signals Directorate in FY2024–25, with average cybercrime costs rising to AU$56,571 for small businesses (up 14 per cent) and AU$97,166 for medium businesses (up 55 per cent). (ASD, Annual Cyber Threat Report 2024–25)
93 per cent of cyber-attacks now target backup storage specifically, to remove an organisation’s ability to recover without paying a ransom. (Veeam)
Only 67 per cent of Australian government entities reached Essential Eight Maturity Level 2 or higher for regular backups in FY2024–25 — still below the 70 per cent recorded before the standard was tightened in November 2023. (ASD, The Commonwealth Cyber Security Posture in 2025)
The global backup-as-a-service market is forecast to grow from US$10.99 billion in 2025 to US$132.02 billion by 2034, a compound annual growth rate of 31.81 per cent. (Fortune Business Insights)
Frequently asked questions
How is backup as a service different from traditional backup?
Traditional backup usually means running servers, tape, or software in-house. Backup as a service moves that infrastructure and management to a provider, who stores the data offsite — often in immutable form — and handles testing and recovery.
Is backup as a service secure and compliant for Australian businesses?
A properly configured backup-as-a-service solution stores data in encrypted, immutable form, offsite from the primary environment, and should align with frameworks like the Essential Eight where relevant. Ask any provider how it handles data residency, encryption, and recovery testing before signing on.
Considering backup as a service for an Australian business?
“Our private cloud is single-tenant, so your data — and the control plane that governs it — stays in the Australian data centre you select, never relocated without your authorization, and always managed by local experts.”
See how ThinkOn delivers backup as a service from its Perth data centre, including pricing and Veeam, Compass Data Protect, and Commvault compatibility, on the Accelerated Backup and Recovery page. ThinkOn also has local recovery teams in Perth and Melbourne.
