Backup for ICS and OT systems

In a production environment the ground rules are different from the server room. The system that runs the line, the pumping station or the building automation is often older than the support contracts, is not on the office network, and cannot be touched without something coming to a stop.

Ordinary backup assumes three things that are rarely there: an agent you can install, a network to send data over, and an IT department that can come out. This page is about what applies when none of that holds.

ARJ Distribution sells exclusively through resellers and MSPs in the Nordics — Sweden, Norway, Denmark, Finland and Iceland — never directly to end customers.

Why ordinary backup does not reach here

Four things make an OT environment different, and they hang together.

The systems are older than the tools. A machine that works is not replaced because the operating system stopped getting updates. Technical debt is not a failure in a production environment — it follows from equipment with a twenty-year life and software with five.
The network is separated on purpose. The air gap between the office network and the production network is a security measure. A backup solution that needs connectivity is, in effect, asking the customer to tear it down.
The restore must not need the internet. The vendor states plainly that a restore should not have to download installation packages from the network. That is easy to miss in a lab and impossible to work around on site.
The person who is there is not IT. It is an automation engineer or an operator. The restore has to be something they can do without typing commands into a shell.

And the time scale is a different one. In the server room an outage is measured in what could not be reached. In production it is measured in what was not made, and often in what had to be scrapped. The customer is already doing that calculation — which makes the conversation easier to open here than in an ordinary IT discussion.

What the Xopero Sphere Recovery Drive is

A physical device, not another piece of software. The vendor describes it as a bootable plug and play drive: the machine is started from it, a wizard lets the user pick the source drive and the backup location, and a copy taken in advance is then restored.

Three properties decide whether it fits — not the feature list:

It works without a network. Neither the internet nor a LAN is needed to restore.
It restores to different hardware. A system image can be put back on a machine with a different configuration. The vendor's condition is that the disk capacity is compatible.
It is meant for whoever is standing there. The vendor names engineers, automation specialists and operators as the people who should be able to run the restore themselves, without commands.

1 TB of capacity is the only figure the vendor gives.

Which systems it covers is stated far less precisely. The vendor writes a wide range of operating systems, including Windows and Linux — and names no versions at all. Older Windows and embedded systems appear as examples of the problems OT environments have, not as a support list. Before you promise anything about a particular machine, ask us and we will take the version to the vendor. That is exactly the kind of question we are here for.

And it does not replace ordinary backup. That is the vendor's own wording. The device complements Xopero ONE: the central console handles what sits on the network, the device covers what does not. Data from the device can be copied to external media and imported into Xopero ONE, so what stands isolated still shows up in the same overview.

What has to be in place beforehand

This part matters more than the features, because this is where a deal falls apart afterwards.

The copy has to have been taken already. The device restores a backup that exists, and the backup location has to be specified. It is a recovery tool — not something that discovers by itself that a machine has no protection.
The copy has to be separated from the compromised network. The vendor names an air gap as the condition for the backup to be trustworthy during an attack. A copy that was reachable when it happened is not a copy.
A restore needs physical access to the machine. Someone has to get into the cabinet. That sounds obvious right up until the customer has an unmanned pumping station two hundred kilometres away — and then it is a question of routines, not of product.
The disk capacity has to add up when the restore goes to hardware other than the original.

So there are three routines the customer needs, not just a device: someone takes the copies, someone keeps them separate, and someone has tried a restore before it counts. That is the part you sell. The device makes the restore possible — the routine makes it likely.

Industries and standards the vendor points to

Xopero names these environments as typical for the device: energy, critical infrastructure, medicine, biotechnology, logistics and transport, industry and manufacturing, mining, building management, water utilities and public services.

The list works as prospecting material, but read it for what it is: a description of where the product is meant to fit, not a list of installations.

Three standards are named: ISA/IEC 62443, NIST SP 800-82 and ISO 22301. The vendor writes that the device offers support in meeting them — not that it is certified, and not that it makes the customer compliant. That distinction is worth holding on to in a procurement conversation: the device is a measure to point at in a continuity plan, not a certificate to attach.

Five questions to ask the customer

These five decide both whether the product fits and what we need to check with the vendor before you quote:

Which operating system, and which version? This is precisely the question the vendor's documentation does not answer — and therefore the one we take to them for you. Ask it first, not last.
What does an hour of downtime cost? In a production environment the answer usually exists already, and it is the figure the whole deal should be measured against.
Is there a copy today — and where is it? The device restores an existing backup. If the copy is missing, that is the part to solve first.
Who is on site when it happens? And is it the same person at three in the morning? The answer decides how much has to be possible without IT.
Has anyone tried a restore? A copy nobody has opened is an assumption. In an OT environment it is also an assumption that gets tested for the first time under time pressure.

Why through a distributor

We do not sell to end customers. That is not a courtesy, it is the business model: everything goes through you, and we never compete with you at the customer.

What you get beyond the product: technical pre-sales help before the deal, help in a proof of concept, support in English and Swedish, and a named contact who knows your business instead of a ticket number.

The device is sold per unit. It is hardware — not a licence counted per resource — so the calculation looks different from the rest of the backup range. Tell us how many sites are involved and we will work through the numbers together with you.

In this area the vendor relationship is also a bigger part of the value than usual. The product is newer and its public documentation thinner than for the rest of the range. Questions about a particular machine, a particular operating system or a procurement requirement we take to Xopero, and come back with an answer you can rely on.

Get started

Tell us what kind of environment it is — which systems, how they are separated, and who is on site when something happens — and we will tell you what can be promised and what has to be checked with the vendor first.