Challenge
Increasing pressure to meet Department for Education cybersecurity standards and recovery expectations. Limited IT resources and traditional backup approaches left many schools vulnerable and uncertain whether critical systems and data could be fully recovered after an incident.
Solution
Implemented a layered backup and recovery strategy using Axcient x360Recover™ from ConnectWise and ConnectWise Cloud Backup™. The solution combined immutable backups, centralised monitoring, and protection for both on-premise servers and Microsoft 365® environments.
Results
Schools gained greater confidence in recovery readiness, improved alignment with the Department for Education and risk protection arrangement expectations, reduced operational risk, and centralised backup management without increasing the IT department workload.
Schools manage large volumes of sensitive data across pupils, staff, and families while operating under increasing cybersecurity and compliance expectations. At the same time, many schools have limited IT resources that are often shared across multiple sites.
According to Black Swan Cyber Security Solutions, most schools already have some form of backup in place. However, under the risk protection arrangement introduced by the UK Department for Education (DfE), schools are required to demonstrate they can recover from a cyber incident, not just prevent one. So the issue becomes whether those backups would be available, usable, and meet compliance standards after a serious incident.
At a glance, backup setups often look reassuring. Backups are running, logs are clean, and data is being copied somewhere. Looking a bit closer may tell a different story. Black Swan frequently identifies several common issues:
- Backup storage is still accessible from the main network
- Vulnerability from shared administrative access across systems
- No protection against deletion, ransomware, or tampering
- Restore processes that have not been tested recently
- No clear expectation of how long recovery would take
Shifting the focus from backup to recovery with ConnectWise
Instead of focusing solely on whether backups exist, Black Swan prioritises whether schools can recover quickly and safely without relying on ransom payments. This approach aligns closely with guidance from both the UK DfE and the risk protection arrangement, which emphasise recoverability and operational resilience.
To strengthen recoverability, Black Swan uses Axcient x360Recover™ from ConnectWise to extend the traditional 3-2-1 backup rule with immutable backups. This means there is a version of the data that cannot be changed or deleted, even with administrative access.
“x360Recover gives schools something very important: a recovery point that cannot simply be changed, deleted, or encrypted because an attacker got hold of their credentials. For me, that is the difference between hoping your backups work and having a proper recovery plan.”
For schools, this addresses a very real risk. Most serious incidents now involve some level of credential compromise. If backup systems can be accessed, they can usually be altered. An immutable copy removes that option. Even in a worst-case scenario, there is still a clean recovery point available.
x360Recover gives schools something very important: a recovery point that cannot simply be changed, deleted, or encrypted because an attacker got hold of their credentials. For me, that is the difference between hoping your backups work and having a proper recovery plan.
Covering both sides of a school environment
Schools tend to operate across two main areas:
- On-premise servers
- Cloud-based Microsoft 365
Both carry risk, and both need different protection. Black Swan uses a combination of x360Recover and CW Cloud Backup™ to cover both.
Protecting on-premise infrastructure with x360Recover
For local infrastructure and servers, x360Recover provides:
- Full system backups, not just files
- Local backup for faster recovery
- Replication to the cloud for off-site protection
- Immutable storage to protect against tampering
In practical terms, if a server fails or is encrypted, the protected system can be restored or temporarily run from backup while full recovery takes place. For a school, that can significantly reduce downtime.
Protecting Microsoft 365 with CW Cloud Backup
Microsoft 365 introduces a different challenge. There is often an assumption that Microsoft provides full backup. In reality, it provides retention. If data is deleted, overwritten, or removed during an account compromise, recovery options can be limited.
CW Cloud Backup provides a separate backup layer covering:
- Exchange Online
- SharePoint
- OneDrive
- Microsoft Teams
Backups run regularly throughout the day and are stored independently of the live environment.
If data is lost or accounts are compromised, it can be restored without relying on Microsoft’s native retention. This is particularly relevant in schools, where accidental deletion and phishing-related incidents are both common.
“Microsoft 365 retention is useful, but it is not the same as having a separate backup. Under the shared responsibility model, schools still need to think about how their Microsoft 365 data is protected and recovered. ConnectWise Cloud Backup gives us an independent recovery layer.”
Microsoft 365 retention is useful, but it is not the same as having a separate backup. Under the shared responsibility model, schools still need to think about how their Microsoft 365 data is protected and recovered. ConnectWise Cloud Backup gives us an independent recovery layer.
The results: Greater confidence, resilience, and operational continuity
This combined backup and disaster recovery strategy helps schools demonstrate key requirements expected by the DfE and risk protection arrangement. For the schools supported by Black Swan, the difference is often immediate
Before implementation:
- Backups are in place, but not fully understood
- Limited confidence in recovery
- Hidden dependencies and risks
After implementation:
- Clear structure around how backups are designed
- Confidence that recovery is possible
- Alignment with DfE standards and risk protection arrangement expectations
- Reduced reliance on internal staff to manage backups
Backups become part of how the school stays operational, rather than something running quietly in the background.
“Backups used to be about getting files back, but now they are about keeping the school open. That means protecting the server in the cupboard and the data sitting in Microsoft 365.”
By combining x360Recover and CW Cloud Backup, Black Swan Cyber Security Solutions takes a recovery-first approach that helps schools improve resilience, reduce operational risk, and maintain continuity in the face of evolving cyberthreats.
ConnectWise helps us move the conversation from ‘we have backups’ to ‘we can recover’.
Key takeaways
- Schools need backup strategies designed to withstand modern ransomware attacks and support rapid operational recovery so instruction continues uninterrupted.
- Immutable backups and isolated recovery points help ensure schools can restore critical systems even after credential compromise or targeted backup attacks.
- Combining x360Recover and CW Cloud Backup helps schools protect both Microsoft 365 and on-premise system data while supporting alignment with DfE guidance and risk protection arrangement recovery expectations.
