Pantheon follows the 3-2-1 backup principle: 3 copies of data, on 2 different storage media types, with 1 copy offsite or in the cloud. For clients with higher recovery requirements or compliance mandates, backup frequency, retention periods, and recovery objectives are specified in the service agreement.

RTO is the maximum acceptable time to restore operations after a failure. RPO is the maximum acceptable data loss measured in time. Pantheon designs backup and recovery solutions to meet each client’s specific RTO and RPO targets, which are documented and agreed upon during onboarding.

Pantheon uses immutable backups (copies that cannot be modified or deleted by ransomware), offsite and cloud copies stored separately from the production environment, and backup access controls using separate credentials from production systems. This ensures clean backups are available even if ransomware executes.

Backup recoverability is tested on a regular schedule defined in each client’s service agreement. Test results are documented and reviewed in quarterly vCIO meetings. An untested backup is not a backup — it is an assumption.

Yes. Tested, immutable backup copies are the most reliable recovery path from ransomware. In the event of an attack, Pantheon’s incident response plan activates for containment, forensic investigation, and recovery from clean backups — without paying a ransom.

Yes. HIPAA requires covered entities to have backup procedures and a disaster recovery plan for systems containing PHI. CJIS requires documented procedures for backup and restoration of CJI systems. FDIC guidance and GLBA require financial institutions to maintain business continuity plans. Pantheon’s backup configurations are designed to meet these requirements.

Yes. Backup status, test results, and recovery readiness are documented as part of Pantheon’s vCIO reporting. This documentation is available for HIPAA audits, CJIS reviews, FDIC examinations, and cybersecurity insurance renewals.