At 11:47pm on 13 February 2022, a fast-moving grass fire driven by north-westerly winds reached the outer suburbs of Mildura and cut power to four industrial estates on the town's eastern edge. Among the businesses affected was Riverland Irrigation Supplies, a family-owned distributor employing 34 people. Their server room, housed in a tin-roofed shed on the property, reached 61 degrees Celsius by 3am. Three servers failed. A fourth, containing 14 years of customer account records and order history, failed when power was restored the following morning due to a surge.
Recovery took 19 days. The firm's backup system — a USB drive updated weekly and stored in a desk drawer — had last been successfully verified in 2019. Three years of customer and transaction data were gone. Riverland's general manager, Phil Anstey, later estimated the total impact at approximately $290,000: lost orders during the recovery period, emergency IT costs, and the longer-term attrition of customers who went to competitors during the outage and did not return.
"The thing that haunts me is that the fire didn't even reach our building," Anstey told the Sunraysia Daily in a subsequent interview. "The power outage did more damage than the fire would have."
What business continuity planning actually requires
Riverland's situation — functional backups that had never been properly tested, no documented recovery procedure, no offsite or cloud-based redundancy — is not unusual. A 2024 survey by Datto of 500 Australian SMEs found that 58 percent had experienced at least one significant data loss event in the previous three years. Of those, 41 percent had a backup system in place at the time of the incident. The problem was not the absence of backups; it was that the backups had never been validated under realistic recovery conditions.
A backup that has not been tested is not a backup. It is a hypothesis.
Effective business continuity planning begins with a business impact analysis: a structured assessment of which systems, processes, and data are most critical to operations, and what the financial and reputational cost of losing each for various durations would be. From this analysis emerge two key metrics that drive the entire recovery architecture. The recovery time objective (RTO) defines how long the business can tolerate being without a given system. The recovery point objective (RPO) defines how much data loss is acceptable — in other words, how old a backup can be before the data it does not contain represents an unacceptable gap.
For a business like Riverland, where customer account history is a core operational asset, an RPO of one week was catastrophic. A correctly designed continuity plan would have specified an RPO of 24 hours or less, backed by automated cloud replication rather than a manual USB process.
The layered architecture of modern disaster recovery
Managed service providers delivering business continuity services typically design recovery capabilities in layers. At the foundation is continuous or near-continuous backup to an offsite or cloud location — AWS, Azure, and purpose-built disaster recovery platforms like Zerto or Veeam Cloud Connect are common choices for Australian deployments, with data sovereignty requirements often directing primary replicas to Sydney or Melbourne availability zones.
Above that sits the failover capability: the ability to spin up a virtualised version of critical systems in the cloud within minutes rather than days, enabling staff to continue working even if the physical office is entirely inaccessible. This is not a theoretical capability for large enterprises only. Perth-based MSP Cosec Technology reports that approximately 60 percent of its SME client base now has some form of cloud-based failover configured, up from around 20 percent in 2020.
The third layer — the one most consistently absent from self-managed continuity arrangements — is regular testing. Cosec's standard managed continuity agreement includes quarterly failover tests, conducted without advance notice to the operations team, with results reported against agreed RTO and RPO benchmarks. In the first 12 months of an engagement, Cosec's technology director, Anne-Marie Stratford, says these tests reveal a material gap in approximately 70 percent of clients: a system that was assumed to be covered by the continuity plan but is not, or a recovery time that is significantly longer than the documented target.
The Australian risk landscape
Australia's physical geography creates a business continuity risk profile that is, in several respects, more severe than businesses in comparable economies face. The 2019-20 fire season destroyed or damaged an estimated 3,000 commercial properties. The 2022 eastern Australia floods — the most costly natural disaster in the country's recorded history, with insured losses of $5.87 billion according to the Insurance Council of Australia — caused prolonged disruptions to thousands of businesses across Queensland and New South Wales, many of which were without accessible premises for weeks.
Overlaid on physical risks is the cyber threat. The Australian Cyber Security Centre's most recent annual threat report cited ransomware as "the most significant cybercrime threat to Australian organisations," noting that healthcare, critical infrastructure, and small-to-medium businesses were the most frequently targeted sectors. A ransomware incident is, from a business continuity perspective, functionally equivalent to a hardware failure: systems become inaccessible, data may be lost or encrypted, and recovery depends entirely on the quality and currency of backups and the speed of incident response.
The businesses most exposed are those that have designed their continuity plans around a single threat type. A USB backup survives a cyberattack. It does not survive a fire. A cloud backup survives a fire. It may not survive a ransomware variant that specifically targets connected backup systems before executing its payload — a technique that is increasingly common in attacks on Australian mid-market businesses.
Riverland Irrigation Supplies moved to a managed continuity arrangement with a Mildura-based MSP in mid-2022. Their recovery architecture now includes continuous replication to an Azure vault in New South Wales, daily recovery tests run automatically against a sandboxed environment, and a documented incident response procedure that assigns specific roles to six staff members. Anstey had the document laminated and posted in the lunchroom. The cost of the arrangement is $1,850 per month. He describes the 2022 incident, with some understatement, as "an expensive way to learn what a tested backup is worth."