Resilience built for compliance: Banco de Costa Rica protects Microsoft data with Veeam

BCR is a pillar in the stability of Costa Rica’s economy. To continue to increase prosperity, attract foreign investment, generate employment, and more, the bank must rise to the challenge of new regulatory requirements and more frequent cyberattacks. “Regulations such as CONASSIF 5-24 in Costa Rica require us to have reliable backup and recovery tools for all cloud services,” said Luis David Hidalgo Ureña, Infrastructure Specialist at BCR. “Our industry and status make us a focus for cyber criminals. To guarantee our continued success, we targeted higher levels of resilience.” Previously, BCR made use of built-in Microsoft tools to back up and recover data for this business-critical part of its IT environment. The bank saw an opportunity to reduce risk by investing in more effective resilience measures for its Microsoft data.

“Microsoft 365 and Entra ID are essential to the operation of BCR,” said Gerardo Mora Cordero, Cloud Infrastructure Manager at BCR. “Applications such as Microsoft Teams, SharePoint, and OneDrive allow our employees to collaborate and work productively. And because we handle vast amounts of sensitive data, Entra ID is vital to restricting access to authenticated users. By better protecting our Microsoft data, we saw a chance to simplify compliance and recovery from cyberattacks in one move.”

To enable users to work without interruption, BCR selected Veeam to protect its Microsoft 365 and Entra ID data. “As soon as we connected with Veeam we knew that they were the right vendor for us,” said Hidalgo Ureña. “We were given a dedicated Veeam contact immediately, and all conversations were in Spanish, which was so helpful. Choosing a SaaS option meant that we did not have to worry about the implementation, maintenance, security, or hardware — that’s all taken care of for us to an exceptional standard by Veeam experts.” Mora Cordero added: “Veeam came out on top of our analysis of a range of factors including functionality, technical specifications, cost efficiency, security, and ease of integration.” BCR was able to hit the ground running by working with Veeam to deploy Veeam Data Cloud for both its Microsoft 365 and Entra ID environments at speed. The bank selected the Premium edition of Veeam Data Cloud for Microsoft 365 to enable it to take advantage of the full spectrum of capabilities, including the ability to perform bulk restores at scale and speed.

“Veeam Data Cloud was simple to deploy and is simple to use,” said Hidalgo Ureña. “A fast implementation was important to us as we wanted to boost our resilience as soon as possible and address the risks we had identified in our previous approach. With Veeam, we were able to achieve that goal.” With its new capabilities in place and a full audit trail provided by Veeam, BCR is now better able to meet its regulatory requirements. The bank is also able to reduce the risk of non-compliance and save valuable resources. “Veeam gives us comprehensive, service-level immutability and rapid recovery processes for our Microsoft data that satisfy our statutory  obligations,” said Mora Cordero. “Better yet, Veeam maintains the chain of custody for data, so we can extract the information we need for reporting with a few clicks of the mouse. Veeam provides superb, provable data resilience while decreasing the burden on the IT team — a victory on two fronts.” With Veeam, BCR extended Microsoft 365 data retention from typical native retention periods of 30-90 days to up to 10 years, helping the bank strengthen compliance, governance, and long term data resilience. “For the first time, we have absolute confidence in our ability to recover Microsoft 365 and Entra ID data because of Veeam,” said Hidalgo Ureña. “Our users know that if they’re authorized they’ll be able to access the systems they need to work efficiently, and that the tools and data they require to collaborate will be there around the clock. With Veeam behind us, we’re better prepared for the unexpected, so we can continue bringing important financial services to the people of Costa Rica.”

Accelerated deployment and realization of business value BCR jumped into action to shut down gaps in its resilience strategy with Veeam, allowing it to start harnessing new capabilities sooner. Simplified audit and regulatory compliance processes “New regulations and cyber risks are emerging all the time,” said Mora Cordero. “Veeam helps us stay one step ahead, so we can focus on our central mission while supporting compliance initiatives and maintaining a strong security posture.” Extended Microsoft 365 data retention from days to up to 10 years With the ability to retain Microsoft 365 data for so much longer, BCR is strengthening compliance, governance, and long-term data resilience.