Mario Leiva, specialist in architecting high-availability data protection frameworks across North America, Australia and Europe
TL:DR: MSP backup is backup as a service (BaaS) an MSP sources wholesale and resells under its own brand — done right, the provider runs the infrastructure and never touches your customer relationship. Pricing is usage-based, driven by data volume, retention, and recovery-testing frequency, with no hardware to buy or maintain. In Australia, the criteria that matter most are a genuinely channel-only provider, local data residency, immutable ransomware-resistant storage as standard, and compatibility with the platforms you already run (Veeam, Commvault, Microsoft 365). This guide covers how MSP backup works, what it costs, and what to check before choosing a wholesale partner.
Storage cost is climbing faster than most MSPs can absorb it, and not every provider offering to solve it stays out of your customer relationship — many hyperscaler and generic cloud backup options can, and do, sell direct alongside the partners reselling them. Ransomware raises the stakes further: 93 per cent of cyber-attacks now go after backup storage first, to remove an organisation’s ability to recover without paying a ransom.
A channel-only backup partner carries the infrastructure and cost while never touching your customer relationship.
Glossary
- Backup as a service (BaaS): A subscription model in which a third-party provider manages backup infrastructure, software, storage, and recovery on an organisation’s behalf, rather than that organisation running and maintaining it itself.
- Disaster recovery as a service (DRaaS): A close relative of BaaS focused on full system failover during an outage, rather than file- or application-level recovery.
- Immutable backup: A backup stored in a format that cannot be altered, encrypted, or deleted once written, even if ransomware compromises the primary environment.
- Recovery time objective (RTO): The maximum acceptable length of time a system can be down before it must be restored.
- Recovery point objective (RPO): The maximum acceptable amount of data loss, measured in time, between the last backup and an outage.
- Air-gapped backup: A backup copy that is physically or logically isolated from the production network, so it cannot be reached by an attacker who has already compromised that network.
- Egress fees: Charges a provider applies when data is moved out of its environment — for example, during a recovery or a migration to a different provider.
- Essential Eight: The Australian Signals Directorate’s baseline set of eight mitigation strategies, including regular backups, that organisations use to reduce the risk and impact of cyber security incidents.
What is backup as a service (BaaS)?
Backup as a service is a subscription model where a third-party provider manages your backup infrastructure, storage, and recovery process instead of you running it in-house.
Instead of running and maintaining backup servers, tape libraries, or software licences, an organisation sends its data to a provider who stores it securely offsite — usually in an immutable, encrypted format — and makes it available for fast recovery when needed. BaaS is sometimes used alongside the term managed backup, and it is a close relative of disaster-recovery-as-a-service, which focuses on full system failover rather than file- and application-level recovery; most providers offer both under one data-protection umbrella.
How does managed backup as a service work for MSPs?
Existing backup software sends data to an immutable offsite repository that’s billed per TB and tested on schedule.
Managed backup as a service follows a similar pattern across providers:
- Existing backup software (commonly Veeam or Commvault) or a lightweight connector sends data to the provider’s platform, often over a direct, private connection rather than the public internet.
- The provider stores that data offsite in an immutable repository, meaning once written, backups cannot be altered or deleted, even if ransomware compromises the primary environment.
- Recovery is tested on a regular, scheduled basis rather than assumed to work, so a bad backup is found during a test, not during an actual outage.
- Billing is usage-based, typically per TB stored, so cost scales with the data footprint rather than requiring upfront hardware spend.
What are the benefits of backup as a service for MSPs?
MSPs cut hardware costs, add ransomware-resistant storage, and can resell tested recovery as a margin-bearing service line.
- No backup hardware, tape libraries, or software licences to buy, run, or refresh.
- Immutable, offsite storage that protects backups from ransomware, even if an attack reaches the primary systems.
- Predictable, usage-based pricing instead of large upfront capital spend.
- Faster recovery — lower RTO and RPO — than tape or on-premises-only backup.
- Regular, independently verified recovery testing, useful for audit and compliance requirements.
- Frees up internal IT time for higher-value work.
What does backup as a service cost an MSP?
Cost is usage-based, driven mainly by data volume, retention period, and recovery-testing frequency, so cost tracks actual usage rather than a large upfront hardware purchase.
BaaS pricing is usually driven by a handful of factors rather than a flat rate:
- Data volume: most providers charge per TB stored, so cost tracks the actual footprint.
- Retention period: how long backups are kept before they age out affects total storage.
- Recovery and testing frequency: more frequent, more rigorous recovery testing can carry a premium.
- Software compatibility: working with the platform already in use (Veeam, Commvault, Microsoft 365) avoids a costly re-platform.
The advantage over traditional backup is that there is no large upfront hardware purchase. Cost is based on usage, which makes budgeting more predictable and avoids over- or under-provisioning.
What should MSPs look for in a backup as a service provider in Australia?
Look for Australian data residency, immutable storage as standard, compatibility with your existing backup software, scheduled recovery testing, and alignment with frameworks like the Essential Eight.
- Australian data residency, ideally with a local data centre rather than an offshore-only option.
- Immutable, ransomware-resistant storage as standard, not an add-on.
- Compatibility with the backup software already in use (Veeam, Commvault, Microsoft 365 connectors).
- Recovery that is actually tested on a schedule, not just backups that are taken and never verified.
- Alignment with Australian compliance frameworks, including the Essential Eight where relevant to the sector.
- Transparent, usage-based pricing with no surprise egress or recovery fees.
- Clarity on jurisdictional exposure — whether a provider’s ownership structure could expose data to a foreign disclosure law such as the CLOUD Act, even when the data itself sits in Australia.
Who offers backup as a service in Australia?
Backup as a service in Australia is offered by global hyperscalers, national managed service providers, and Australian-based specialists including ThinkOn, which delivers immutable, ransomware-resistant backup with scheduled recovery testing.
The comparison below sets out the criteria to check regardless of which provider is under consideration.
Comparing backup as a service approaches
| Criteria | DIY / on-premises backup | Generic cloud or hyperscaler backup | ThinkOn backup as a service |
| Data residency | Depends entirely on where hardware is purchased and hosted | Often mirrors to the nearest regional zone; may replicate outside Australia | Perth data centre (P1); Western Australian data stored and managed locally |
| Jurisdictional / CLOUD Act exposure | N/A — data stays wherever the organisation’s own hardware sits | May be subject to foreign disclosure laws (e.g., the CLOUD Act) regardless of where data is physically stored | Canadian-owned and Australian-operated; no US parent or US-headquartered entity in the ownership chain. |
| Immutable storage | Rarely default; usually requires separate configuration | Available but frequently an add-on | Hardened Repository — immutable, ransomware-resistant storage as standard |
| Software compatibility | Whatever the organisation already licenses, unsupported if that changes | Varies by provider; often requires re-platforming | Veeam Cloud Connect, Compass Data Protect (Microsoft 365), and Commvault support |
| Recovery testing | Ad hoc, if it happens at all | Varies by provider | Tested on a scheduled, certified basis |
| Pricing model | Large upfront capital spend on hardware and licences | Usage-based, but egress or recovery fees are common | Usage-based, per TB stored, with no egress fees |
| Compliance framework alignment | Depends entirely on the internal team’s own programme | Varies by provider | Supports alignment with frameworks such as the Essential Eight where relevant to the sector |
Explore local cloud storage options designed to help Australian MSPs manage growing data volumes and control storage costs.
Key figures at a glance
138 ransomware incidents were responded to by the Australian Signals Directorate in FY2024–25, with average cybercrime costs rising to AU$56,571 for small businesses (up 14 per cent) and AU$97,166 for medium businesses (up 55 per cent). (ASD, Annual Cyber Threat Report 2024–25)
93 per cent of cyber-attacks now target backup storage specifically, to remove an organisation’s ability to recover without paying a ransom. (Veeam)
Only 67 per cent of Australian government entities reached Essential Eight Maturity Level 2 or higher for regular backups in FY2024–25 — still below the 70 per cent recorded before the standard was tightened in November 2023. (ASD, The Commonwealth Cyber Security Posture in 2025)
The global backup-as-a-service market is forecast to grow from US$10.99 billion in 2025 to US$132.02 billion by 2034, a compound annual growth rate of 31.81 per cent. (Fortune Business Insights)
Frequently asked questions
How is backup as a service different from traditional backup?
Traditional backup usually means running servers, tape, or software in-house. Backup as a service moves that infrastructure and management to a provider, who stores the data offsite — often in immutable form — and handles testing and recovery.
Is backup as a service secure and compliant for Australian businesses?
A properly configured backup-as-a-service solution stores data in encrypted, immutable form, offsite from the primary environment, and should align with frameworks like the Essential Eight where relevant. Ask any provider how it handles data residency, encryption, and recovery testing before signing on.
What is an immutable backup and how does it protect against ransomware?
An immutable backup is unmodifiable data locked for a set period, preventing ransomware from encrypting or deleting your recovery points.
ThinkOn’s cloud solutions enforce strict read-only retention policies to lock your critical recovery data down. This ensures that even if production environments are compromised, your backup copies remain entirely tamper-proof and ready for safe restoration.
How do you recover from ransomware without reinfecting?
To recover from ransomware without reinfecting, isolate recovery data in an automated Cleanroom Recovery environment for forensic scanning to break the re-infection loop before production restoration.
This structured process ensures malicious payloads are completely purged during the restoration workflow. By leveraging immutable storage and secure sandbox recovery, MSPs can safely restore clean data without triggering a re-infection loop.
How do MSPs help clients meet Essential Eight?
MSPs help clients meet the Essential Eight by implementing baseline mitigation strategies like multi-factor authentication, application control, and regular data backups.
ThinkOn supports these compliance efforts by providing sovereign cloud infrastructure backed by immutable backups and automated cleanroom recovery. This ensures MSPs can easily satisfy strict Australian data protection standards and deliver reliable business continuity for their clients.
Which cloud backup solution is best for a small MSP managing client backups?
The best option for a small MSP offers multi-tenant management, white-label delivery, immutable storage and predictable per-TB pricing.
Those four together let a small team run many clients from one console without margin leaking to egress or add-on fees.
What is multi-tenant backup management, and why does it matter for an MSP?
Multi-tenant backup management runs every client’s backups from one console, with each client’s data kept separate and isolated. It matters because it decides how many customers one engineer can support — the largest single driver of whether a backup service line is profitable at small scale.
Can an MSP deliver backup as a service under its own brand?
Yes. White-label delivery lets the MSP own the customer relationship, the branding and the invoice, end to end. The provider supplies the underlying storage and infrastructure. A channel-only provider never sells direct, so the account stays with the MSP.
How do MSPs protect margin on cloud backup?
MSPs protect margin by removing variable charges — egress, per-API-request, early-deletion and minimum-term fees — and locking the underlying rate. Predictable input cost is what lets an MSP price a service confidently and keep the spread between what it pays and what it charges.
What should an MSP compare when evaluating backup providers?
Compare total cost, not headline rate per TB: storage rate, egress, API charges, retrieval tiers and minimum terms. Also compare whether immutability is included or sold as an add-on tier, and whether the provider sells direct to your customers.
Can you compare pricing and features of MSP360, CloudBerry, and Backblaze for MSPs?
MSP360 (formerly CloudBerry) prices per workload plus your own storage choice; Backblaze B2 is storage alone, often used together.
MSP360 and CloudBerry Backup are actually the same product — CloudBerry Lab rebranded as MSP360 in 2019, so any pricing or feature comparison between them is really “MSP360 vs. Backblaze.”
