The instruction to verify immutable, offline and air-gapped as three separate controls [4] arrives without definitions for the second and third, so the test is the buyer's to write. The source does give its shape: evidence from the exact tenant, workload, storage configuration and service tier being sold [5]. That question lives in the contract, not the platform architecture document. Who holds delete rights over one tenant's recovery points, in which storage configuration, is a per-contract answer.
The entry-point numbers argue against spending the next dollar on storage. Phishing accounted for 52% of initial access cases in the Acronis data and unpatched vulnerabilities for 27% [2], which puts 79% of entries in two categories and leaves 21% for everything else [1]. The same report counted 143 victims among MSPs, IT-service providers and telecom operators across 2025 [1], roughly one every two and a half days [2]. Immutability touches neither dominant vector, and the source says so when it notes that immutable backup does not detect data theft and does not replace incident response [6].
Recovery time is where the six outcomes become measurable. The source defines it as the total of detection, triage, containment, clean-point selection, restoration and validation [9]. Six terms, and a datasheet restore rate speaks to one of them [3]. Clean-point selection is the term that decides whether the restore was worth running: the guidance is to take the latest recovery point that predates compromise and passes validation, with the incident team confirming that it does [10]. Automation can remove repeatable waits, but an incident commander should approve mass isolation, credential resets and failover [12].
Double extortion is where the backup-only plan runs out. Immutable copies preserve recoverability, but the data attackers already took stays taken, and breach-notification duties remain due [7]. Catching exfiltration before encryption means correlating endpoint, identity, email, Microsoft 365, DNS, proxy and egress telemetry [8], which is a different purchase from storage, and it is the layer the checklist assigns to EDR, XDR and a staffed 24/7 service rather than to backup [15].
Read the six outcomes [3] as a specification you hold a vendor to, because the piece carrying them also sells Acronis Cyber Protect Cloud with Acronis MDR as the single multi-tenant platform that delivers them, down to an "Explore Acronis MDR" prompt [14]. The part that survives the sales copy is the drill record: log achieved RPO and RTO after each rehearsal along with every delay, then revise the runbook from that rather than from estimated restore speed [11]. The same document concedes that no tool guarantees recovery in every attack, while a rehearsed path keeps open the option of recovering without paying [13]. Producing that log, per tenant, for last quarter is what turns the vendor's numbers into the MSP's own.
