Aventura, Florida · serving clients across the United States (305) 404-9404Toll-free (800) 767-8566Emergency? Get a call within 1 hour
Healthcare services Illustrative engagement

A multi-clinic group moves its practice-management SQL Server to Always On with point-in-time restore

A healthcare group of 12 clinics with about 700 staff.

Scale
~600 GB across 5 databases, 2 synchronous replicas plus 1 asynchronous disaster recovery replica
Engagement
6 months, with cutover in one weekend

The challenge

The practice-management database ran on one aging SQL Server with nightly backups. A failure would lose a day of records and take clinics back to paper, and the team had never timed a restore.

What our team delivered

  • An availability group with two synchronous replicas in the primary data center for automatic failover and one asynchronous replica in a second region for disaster recovery
  • Full, differential and transaction log backups every 15 minutes, with backup checksums, so any point in time can be restored
  • A scheduled restore to a separate server, followed by DBCC CHECKDB, with the elapsed time recorded against the recovery objective
  • Encryption in transit and Transparent Data Encryption, with keys stored apart from backups
  • The move itself rehearsed twice, with a rollback plan and a final cutover in one weekend window
  • Monitoring for replica health, log send queue and backup age, with alerts to named engineers

Result

A failed replica is now a routine alert rather than an outage, and a restore to a chosen minute has been performed and timed. The clinics know their recovery point and time because they were measured.

Get this for your company

Related services with fixed prices and a written scope.

Insurance-ready bundle

The three things cyber insurers and clients ask for most: an external assessment, a phishing simulation for 25 users and a disaster recovery plan.

$5,400 per bundle, phishing simulation for 25 users

Show 2 more

Active Directory health check

Find the misconfigurations that let an attacker go from one stolen password to full control of your domain.

$1,800 per domain

After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.

No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).

Backup tiers: data lost versus time to recover

Recovery point objective (RPO) is how much recent data a restore loses; recovery time objective (RTO) is how long the restore takes. Faster tiers sit close to the production system and share its fate; slower tiers survive ransomware and site loss. The scale is logarithmic. Illustrative figures.

Backup tiers: data lost versus time to recoverPaired horizontal bars on a logarithmic time scale. Snapshot: RPO 1 hour, RTO 15 minutes. Replica: RPO 1 minute, RTO 5 minutes. Immutable object store: RPO 1 day, RTO 4 hours. Offline copy: RPO 7 days, RTO 1 day.RPO and RTO by backup tier (log scale)RPO: data lostRTO: time to recover1 min10 min1 h6 h1 day7 daysSnapshotsame array, same failure domain1 h15 minReplicasecond site, asynchronous1 min5 minImmutable object storewrite-once, cannot be altered1 d4 hOffline copyair-gapped, no network path7 d1 dKeep one tier of each kind: the fast one restores quickly, the immutable one survives an attacker with admin rights.

Failover in under a second

ISP A fails at 300 ms. BFD (RFC 5880) with a 50 ms interval and multiplier 3 declares the session down 150 ms later, BGP withdraws the routes, and the forwarding table repoints to ISP B. Traffic is back at full rate in well under a second; without BFD the router would wait for the 90 s BGP hold timer. Illustrative figures.

Failover in under a secondLine chart over 1.2 seconds. ISP A carries 8 gigabits per second until 300 milliseconds, then drops to zero. ISP B carries nothing until about 650 milliseconds and reaches 8 gigabits per second at 720 milliseconds. Roughly 400 milliseconds of loss in between.Traffic per upstream during a link failureISP A (primary)ISP B (standby)04812Gb/s0200 ms400 ms600 ms800 ms1000 ms1200 msabout 400 ms of loss1 Link to ISP A fails2 BFD: 3 missed hellos (3 × 50 ms), session down3 Routes withdrawn, FIB repointed to ISP BWithout BFD, BGP would wait for the 90 s hold timer (30 s keepalives).

Every sign-in, verified

Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.

Every sign-in, verifiedDiagram of user authentication. A user signs in; the device is checked for MDM and Intune compliance; the identity provider, Active Directory or Entra ID, verifies the account; an MFA push is approved on the user's phone; conditional access evaluates the policy; and access is granted to email, ERP and files. On a second pass, a sign-in from an unknown device in a new location is blocked by the conditional access policy. VERIFIED SIGN-INUserSigns inDevice checkMDM · IntuneIdentityAD · Entra IDMFA pushPhone approvalConditionalaccessPolicy checkEmailERPFilesUnknown deviceNew locationApprove?Blocked

Do you know if your company is safe?

Speak with a security engineer today. The first assessment call is free and confidential.

CallFree assessment