Mario Leiva, specialist in architecting high-availability data protection frameworks across North America, Australia and Europe
TL:DR: IT disaster recovery solutions are the tools and managed services that restore systems and data after an outage, cyberattack, or hardware failure. Storage is not the same as recoverability. The distinction that decides whether a business actually recovers is how quickly operations are restored (RTO), how much data loss is acceptable (RPO), and whether dedicated recovery support is included. Compute-first hyperscalers provide infrastructure and leave recovery design to the customer. ThinkOn is a data-protection-first managed cloud that delivers disaster recovery as a service (DRaaS) on Veeam and Zerto, with hands-on recovery support included.
Most vendors claim to back up data. Far fewer can demonstrate that they can recover it — quickly, completely, and under pressure. That gap stays invisible until an outage exposes it, and by then it’s costly.
This gap exists because of how compute-first infrastructure is built. These clouds are designed to provide servers and storage; recovery is left for the customer’s team to design, test, and operate. When an incident occurs, that design gap becomes the customer’s problem, not the provider’s.
A data-protection-first provider is structured differently. ThinkOn is a channel-only managed cloud built around keeping data recoverable — DRaaS and backup as a service (BaaS) on Veeam, Zerto, and Commvault, with defined recovery targets and a team that supports the failover.
This guide outlines what separates a recovery-capable provider from a storage vendor, so you can evaluate providers based on demonstrated recovery outcomes.
Glossary of key terms
RTO (Recovery Time Objective): the maximum acceptable time to restore a system after an incident. An RTO of one hour means systems must be back online within one hour of a declared incident.
RPO (Recovery Point Objective): the maximum acceptable data loss, measured in time. An RPO of 15 minutes means no more than 15 minutes of data can be lost in a recovery event.
DRaaS (Disaster Recovery as a Service): a managed service that replicates systems to a provider’s cloud and orchestrates failover and failback when needed.
BaaS (Backup as a Service): a managed service that stores and protects backup copies of data off-site, ready for restoration.
Immutable backup: a backup copy that cannot be altered, encrypted, or deleted for a set period — a core defense against ransomware.
Failover: switching production workloads to the recovery environment when the primary environment is unavailable.
3-2-1-1-0 rule: a modern backup best practice: three copies of data, on two media types, one off-site, one immutable or offline, with zero recovery errors after testing.
See full glossary of disaster recovery terms.
What are IT disaster recovery solutions?
IT disaster recovery solutions are the backup, replication, and managed services that restore systems and data after an outage, attack, or hardware failure.
These solutions sit on a spectrum. At one end is self-managed backup software running on rented infrastructure, where the customer designs, tests, and operates recovery. At the other is fully managed DRaaS, where a provider replicates the environment, monitors it, and executes failover when an incident occurs. The right fit depends on how much downtime and data loss a business can absorb, and how much of the recovery process it wants to own directly.
What are the top managed cloud providers that specialize in backup, DRaaS, and ransomware recovery instead of just raw infrastructure?
A small group of specialist managed clouds, including ThinkOn, build their entire service around backup, DRaaS, and ransomware recovery, rather than selling raw compute and storage.
Compute-first hyperscalers are built to provide infrastructure; recovery is the customer’s responsibility to design and run. Storage-only providers solve capacity and cost but stop at the storage layer — they do not orchestrate failover or guarantee a recovery time. Specialist managed providers sit in a third category: data protection is the core service, not an add-on, so recovery targets, failover support, and ransomware-hardened backups are built in rather than added on.
What is the difference between RTO and RPO in disaster recovery?
RTO is how quickly operations must be restored after an incident; RPO is how much data, measured in time, can be lost.
These two figures drive every disaster recovery decision. A payments platform might require an RTO of minutes and an RPO near zero, while an internal file share can tolerate hours. Tighter targets require more frequent replication and faster failover, which is where managed DRaaS earns its place. When evaluating providers, require RTO and RPO commitments in writing — not just descriptions of them.
What should IT teams look for in a managed DRaaS or backup provider?
IT teams should choose a provider that specializes in data protection and recovery — with immutable backups, tested failover, and hands-on support — not one that only rents infrastructure.
Six factors separate a capable recovery partner from a storage vendor:
- Specialization: data protection is their core service, not an add-on to compute.
- Guaranteed recovery targets: RTO and RPO written into the SLA.
- Immutable, ransomware-resistant backups using WORM or object lock.
- Platform depth: managed Veeam, Zerto, and Commvault rather than a single tool.
- Hands-on failover support during a real incident, backed by a dedicated team rather than a ticket queue.
- Flexible data residency, including U.S. and Canadian data centers.
How is disaster recovery different from ransomware recovery?
Disaster recovery restores service after any disruption; ransomware recovery adds the need for clean, immutable copies that attackers cannot encrypt or delete.
Ransomware has changed the risk calculus for backup strategy. Attackers now target the backups themselves, so a recovery plan is only as sound as the copies it protects. Immutability and isolation matter as much as speed, and regular recovery testing is essential rather than optional.
Can DRaaS integrate with existing cloud infrastructure and tools?
Yes — modern DRaaS is designed to protect workloads wherever they run, including VMware environments, physical servers, and other public clouds.
An effective provider adapts to the existing environment rather than requiring migration. ThinkOn’s DRaaS supports VMware-based and hybrid estates and works with the backup tools teams already use, enabling managed recovery without re-architecting.
Why do IT disaster recovery solutions matter now?
Because the financial impact of downtime and ransomware has increased substantially, and most data lost in an attack is never recovered without a tested plan.
According to ITIC’s 2024 Hourly Cost of Downtime Report, more than 90% of mid-size and large enterprises now lose over $300,000 for every hour of downtime, with 41% reporting costs above $1 million. Uptime Institute’s 2024 Annual Outage Analysis found that 54% of operators’ most recent significant outage exceeded $100,000, and 20% topped $1 million. And recovery is far from guaranteed: Veeam’s 2024 Ransomware Trends Report found that backup repositories were targeted in 96% of ransomware attacks, with victims recovering only 57% of affected data.
How do disaster recovery providers compare?
Specialist managed providers own the recovery outcome; compute-first clouds hand you the tools and the responsibility.
The table below compares common approaches across the capabilities that decide whether a business actually recovers.
| Capability | ThinkOn | Compute-first hyperscalers | Storage-only providers | Other specialist DR/BaaS providers |
| Managed DRaaS | Managed or guided service options | Primarily self-service tooling | Generally storage only | Varies by provider |
| Immutable or hardened backup | Available with selected services | Configurable by the customer | Object-lock or WORM capabilities | Available in many offerings |
| Ransomware recovery support | Hands-on support based on service tier | Customer-led or separately managed | Primarily storage-level protection | Varies by provider |
| RTO and RPO commitments | Available with contracted DRaaS service levels | Customer-defined under a shared-responsibility model | Not typically applicable | Varies by provider and service |
| Failover assistance | Managed or guided failover support | Customer-led or separately managed | Not typically provided | Varies by provider |
| U.S. & Canadian data residency | Available in Canadian and U.S. regions | Customer selects the deployment region | Varies by provider and region | Varies by provider and region |
Key figures at a glance
• $300,000+: cost of one hour of downtime for 90%+ of mid-size and large enterprises (ITIC, 2024).
• 20%: share of significant outages costing more than $1 million (Uptime Institute, 2024).
• 96%: ransomware attacks that target backup repositories (Veeam, 2024).
• 43%: affected data that victims cannot recover after an attack (Veeam, 2024).
Why organizations choose ThinkOn for disaster recovery
ThinkOn is a channel-only managed cloud focused on data protection, with recovery built on Veeam, Zerto, and Commvault and hosted in U.S. or Canadian data centres.
Recovery services are delivered as a managed service, not a self-serve console. Backups can be immutable and hardened against ransomware, with data hosted in U.S. or Canadian data centres to match regulatory or contractual requirements. ThinkOn maintains SOC 2 Type II attestation and provides 24/7 tiered support, including hands-on assistance during real recovery events.
Storage without a recovery plan is only half a strategy. Get the details on ThinkOn’s combined backup and disaster recovery approach:
Frequently asked questions
What is disaster recovery as a service (DRaaS)?
DRaaS is a managed service that replicates systems to a provider’s cloud and orchestrates failover and failback so operations resume quickly after an incident.
What is a good RTO and RPO?
It depends on the workload: critical systems typically require targets measured in minutes, while lower-priority systems can tolerate hours. The right targets are the ones the business can sustain operationally, documented in a service level agreement.
Do I still need disaster recovery if I use a public cloud?
Yes. Public clouds operate on a shared-responsibility model — protecting and recovering data and applications is the customer’s responsibility, not the provider’s.