Back up offline is not available v2026.5

Hi Mike_MYOB​ 

I'd like to address this part of your reply - from my perspective as an Information Security Management Systems auditor - 

• Big companies need to have a running backup taken off premises.
  • Are you able to share any more supporting information around this? To my knowledge most/all of our competitors don't offer an offline backup, so I would like to take a further look at this mandatory rule and how it applies.
    I would assume that MYOB hosting the online backup will be considered a back up that is not held on premise for that business.

There's an important distinction between offsite and offline backup, and MYOB hosting our backup in the cloud only satisfies the former.

• Offsite just means the data is stored somewhere geographically separate — it protects against a local disaster (fire, flood, hardware failure at our premises).
• Offline (or air-gapped/immutable) means the backup has no live network connection to production systems, so it can't be reached, encrypted, or deleted if ransomware compromises our environment or the platform it's connected to.

MYOB's hosted backup is always-on and logically connected via our authenticated account. If our MYOB access or the platform itself were compromised, that backup is potentially in the blast radius too — it doesn't give us a genuinely isolated recovery point.

This isn't just a nice-to-have. It's a specific, named requirement under the frameworks Australian businesses are increasingly being assessed against:

ISO 27001:2022 — Information Backup — audit guidance under this control treats "backups logically connected to production with no immutable protection" as a fail condition, separate from whether the copy is geographically offsite. Standard guidance explicitly recommends a full backup kept offline (external drive or NAS, disconnected after each run) specifically because "if the drive stays online and accessible, malware can still infect those files."

SMB1001:2026 — backup and recovery is one of five assessed domains, and air-gapped/immutable backup strategies are a named requirement at the higher certification tiers (Gold and above). Relying solely on a vendor's built-in retention isn't treated as an equivalent control.

By removing the ability to take a local/offline backup, MYOB isn't just removing a convenience feature — it's removing our ability to meet a documented control that our clients, insurers, and auditors are actively checking for. "We back it up too" doesn't close that gap, because it's the same connected environment being relied on twice, not an independent recovery point.

Could you clarify whether there's any roadmap to reinstate an offline/exportable backup option, even as a manual or scheduled export rather than a live sync? For businesses pursuing ISO 27001 or SMB1001 certification, this isn't optional.

To this end, we also back up our Microsoft environment, and all other business critical information, with daily immutable backups.  And so, I will repeat my earlier point - Relying solely on a vendor's built-in retention isn't treated as an equivalent control.