Making the grade: GEMS safeguards student and faculty data with Veeam

For GEMS, user access to digital tools such as Microsoft 365 and Entra ID is not a nice-to-have, it’s essential. To deliver learning reliably and with certainty to users across the world, the company prioritizes data resilience. However, a fast-changing cyberthreat landscape and an evolving regulatory environment introduced new challenges.

“Our mission is to deliver world-class education while continually enhancing the experiences of our students, teachers, parents, and support staff,” said Jason Fernandes, Vice President and Head of Technology Infrastructure and Operations at GEMS Education. “Scaling this globally presents a complex and demanding challenge. As cyber attackers become increasingly creative and relentless, our compliance obligations rise too. The current geopolitical situation in the Middle East, where we are headquartered, further elevates our risk of attack.”

Previously, GEMS relied on native data protection and retention tools for its Microsoft 365 and Entra ID data. Internal scenario testing identified gaps in the company’s ability to perform rapid, large-scale recovery and to restore data efficiently.

“Microsoft 365 is our primary platform for communication, collaboration, document management, and educational resources across GEMS schools and corporate functions, while Entra ID allows us to manage identities and access,” said Fernandes. “Any significant downtime or data loss would severely impact our ability to deliver educational services to students, making it not an option. We set out to ensure we could recover data quickly and cleanly if a cyber incident or operational issue were to occur.”

GEMS has used Veeam for many years to protect its on-premises infrastructure in schools and at its corporate data centers. 

“Extending that protection to Microsoft 365 and Entra ID was a natural next step in our cyber resilience strategy. Our evaluation criteria focused on data immutability, security, granular recovery, ease of management, scalability, compliance, and total cost of ownership” said Fernandes. “Veeam stood out because it combined these capabilities in a mature, easy-to-operate SaaS platform.”

GEMS uses Veeam to protect 1.5 PB+ of Microsoft data across its global network of schools and corporate functions. It safeguards critical Microsoft 365 workloads, including Exchange Online, SharePoint Online, OneDrive, Teams, and Entra ID. For backup storage, GEMS uses Microsoft Azure Backup Storage for critical staff and Azure cloud storage for other users, providing a balance between resilience, performance, and cost-efficiency.

“The deployment was straightforward and, because we chose a SaaS option, we didn’t have to provision any additional infrastructure on our side,” said Fernandes. “The onboarding process was simple, integration with Microsoft 365 was seamless, and we were able to start protecting our workloads quickly with minimal effort from our team. We benefit from predictable costs alongside scalability on demand, allowing us to focus on delivering value to the business and exploring growth opportunities.”

Using Veeam, GEMS has dramatically strengthened protection for its Microsoft data and enhanced its ability to recover from disaster at speed. As a result, the company can deliver outstanding experiences to users worldwide around the clock.

“Veeam is a core pillar of our data resilience strategy, not just a backup tool,” said Kausar Mukeri, Chief Information Security Officer (CISO) at GEMS Education. “We now store immutable backups of our Microsoft data in hardened, air-gapped repositories that even an administrator with full domain credentials cannot alter or delete within the retention window. That immutability is our last line of defense against ransomware: Even if an attacker gains privileged access to our production environment, they cannot compromise the backup data itself. Veeam also gives us role-based access controls [RBAC], multi-factor authentication [MFA], and four-eyes approval for sensitive operations, such as deleting backup jobs or shortening retention, adding another layer of protection against both external attackers and insider risk.”

With the completed Veeam deployment, it is now simpler and more efficient for GEMS to comply with regulations, and to prove compliance status. To achieve ISO 27001 and SOC 2 certifications, for example, the company pulls job logs, retention reporting, and audit trails from Veeam as evidence of backup frequency, retention adherence, restore testing, and access-control enforcement. Veeam also helps GEMS enforce data retention and deletion policies consistently across its estate, including scoped retention for systems that process personal data.

“By retrieving evidence for regulatory reporting directly from Veeam, we shorten audit cycles and strengthen the evidence chain,” said Mukeri. “With the control and insight Veeam gives us into data retention, we can respond to data subject requests faster and more efficiently. Veeam gives us confidence that we’ve taken multiple measures to limit a cyber attacker’s leverage and shorten our time to recovery — and that we can demonstrate that to regulators.”

• Protects 1.5 PB+ of data across a global network of schools and corporate functions
  GEMS was able to rapidly deploy and onboard Veeam for its Microsoft data, enabling it to start benefitting from its new capabilities, predictable pricing, and on-demand scaling fast.
• Strengthens cyber-resilience significantly, reducing the risk of compromise and accelerating recovery
  GEMS is minimizing disruption to learning with measures such as RBAC controls, MFA, and four-eyes approval for sensitive operations, alongside storing immutable backups of Microsoft data in hardened, air-gapped repositories.
• Shortens audit cycles and strengthens the compliance evidence chain
  Using Veeam, GEMS can more easily fulfil its regulatory obligations. The company can also respond faster and more effectively to external requests for data.