Backup and Disaster Recovery for Schools in Perth

A ransomware attack the week before NAPLAN, or a corrupted database two days before term reports are due, doesn't just cost a school money - it disrupts students, parents, and regulatory deadlines that can't simply be rescheduled. School backup and disaster recovery needs to be planned around the academic calendar, not treated as a generic business IT checkbox.

What Makes School Data Recovery Different

A typical Perth school runs a student management system (Compass, SEQTA, TASS, or Synergetic), a finance and enrolment platform, learning management tools, and increasingly its own Microsoft 365 or Google Workspace tenant for staff and student email and files. Each of these holds data with a different recovery priority and a different owner - some sits with the vendor's cloud infrastructure, some sits with the school's own IT environment, and many schools don't have a clear picture of where the line between the two actually falls.

Most student management vendors operate on a shared-responsibility model: they protect their platform from outages and disasters on their end, but accidental deletions, sync errors, or a ransomware attack against the school's own network are generally the school's responsibility to recover from, not the vendor's.

What Needs a Documented Recovery Plan

• Student records and enrolment data - including historical records that may be needed for transfers, references, or legal requests years after a student has left.
• Current-term timetabling and attendance data - needed daily, with very little tolerance for extended downtime.
• Staff and student Microsoft 365 or Google Workspace data - mailboxes, shared drives, and Teams or Classroom content, which most cloud platforms don't fully protect against accidental deletion or ransomware without a dedicated third-party backup.
• Financial, payroll, and fee management systems - critical for school operations and subject to its own compliance requirements.
• NAPLAN and other reporting-period data - tied to fixed external deadlines that don't move because of an IT incident.

Building a Recovery Plan Around the School Term

Disaster recovery plans for schools work best when they account for the academic calendar rather than treating every day as equivalent. A school holiday period is the ideal time to schedule full test restores, since a problem discovered then has far less impact than one discovered mid-term. Conversely, change windows, software updates, and infrastructure work should be scheduled to avoid reporting periods and exam blocks wherever possible.

Setting Recovery Time and Recovery Point Objectives

Recovery Time Objective (RTO) is how long the school can tolerate a system being down; Recovery Point Objective (RPO) is how much data loss is acceptable, measured in time since the last backup. For a school, attendance and timetabling systems typically need a short RTO and RPO measured in hours, since staff rely on them every school day, while historical enrolment archives can tolerate a longer recovery window.

Testing Is the Part Most Schools Skip

Having backups configured isn't the same as knowing they work. A backup that's never been restored is, at best, an assumption. Schools should schedule at least one test restore per term and a full disaster recovery test annually, ideally during a holiday period, and document the results for cyber insurance and governance purposes.

Frequently Asked Questions

For related reading, see our guides to IT Support for Schools in Perth and How to Test Your Business Backup.