CIO / VP of IT
Recoverability evidence and executive reporting instead of assumptions, with one accountable partner across the lifecycle.
Protect · Platforms we sell and architect
Data Protection &
Cyber Recovery.
Every environment has backups. Far fewer can prove recovery: clean data, working identity, applications validated, in an order somebody has actually rehearsed. ModernOps architects protection around the restore, separates it from the blast radius, monitors it around the clock and tests it on a schedule. Then, when it matters, one team runs the recovery.
24/7 NOC
Monthly test restores
PA + AZ regions
CISO / Risk Leader
Ransomware-resistant copies, reduced blast radius, clean-point recovery and continuously validated readiness.
Data Protection Lead
One coherent architecture across backup platforms, repositories, replication, SaaS and cloud, with RPO and RTO you can actually hit.
Operations / Continuity Lead
Monitored jobs, ticket-driven remediation, declaration procedures and post-test action tracking.
03The decision
Key design
considerations.
01 /
Backup software or backup outcome.
Refresh the platform you operate, or subscribe to BaaS and make restore success someone’s SLA. The honest answer depends on your team, not the product.
02 /
“The job succeeded” is not evidence.
A green checkmark proves a task completed. Recoverability requires restoring the data, starting the application and confirming someone can log in. That is why restore validation runs monthly here, not annually after an incident.
03 /
One blast radius.
Backups that share storage, credentials or network fate with production die with production. The design standard is 3-2-1-1-0: separated repositories, an off-site copy, an immutable or air-gapped copy, and zero unverified restores.
04 /
Identity is in the blast radius now.
Microsoft 365, Entra ID and Active Directory are production systems. A recovery plan that restores servers nobody can log into is not a recovery plan. Identity comes back first, which is exactly how our recovery playbook sequences it.
05 /
The newest copy is not the cleanest copy.
Restoring the latest backup after ransomware often restores the ransomware. Clean recovery means anomaly and malware checks, clean-point selection and validation in an isolated environment before anything touches production.
04What we architect
Reference
architectures.
Pattern 01
Scale-out appliance clusters replacing aging purpose-built backup hardware, with retention lock, replication between sites and capacity sized for growth instead of last cycle’s estate.
Pattern 02
Greenfield rollouts consolidating fragmented job-level tooling into policy-driven protection, with onboarding restore validation before go-live.
Pattern 03
Upgrades, hardened repositories and immutable object targets for the largest install base in the mid-market, built to the 3-2-1-1-0 standard.
Pattern 04
Exchange, Teams, SharePoint and OneDrive plus Entra ID and AD objects, protected as first-class workloads. One current design protects 2,700 Microsoft 365 and Entra ID users on dedicated appliances; another scopes roughly 3,900 users, 10,000 directory objects, 1,795 VMs and 100 TB of object storage under one hybrid strategy.
Pattern 05
Continuous replication for the workloads where minutes of data loss are unacceptable, tiered above standard backup and wired into declaration and failback procedures.
Pattern 06
Cyber recovery as an executable workflow: clean-point identification, isolated and non-routable recovery environments, sequenced restoration starting with identity, customer validation gates, and return-to-primary planning. The public version of this thinking is Field Note 02.
05The platforms
Supported
platforms.
Platform projects, upgrades and renewals for teams standardizing on policy-driven protection with strong cyber-recovery tooling.
Scale-out appliance clusters, refreshes and multi-year coterm structuring, extended into Microsoft 365 and Entra ID protection designs. The current standardization target for combined data center, SaaS and identity coverage.
Renewals, upgrades and hardened-repository designs for the platform most mid-market teams already run, plus immutable object targets and 3-2-1-1-0 alignment. Also the engine behind ModernOps BaaS, which means we operate it daily under an SLA, not just quote it.
Continuous replication as the low-RPO tier in a protection architecture: licensing, migrations and renewals, positioned above backup for the workloads that cannot lose an afternoon.
Also on the line card
Commvault, NAKIVO (a hosted BaaS engine alongside Veeam), AFI for SaaS protection, Object First hardened targets, and storage-native protection covered on the Enterprise Storage page.
06The old model vs ModernOps
The ModernOps
difference.
| Dimension | The old model | ModernOps |
|---|---|---|
| Protection scope | Inherited jobs, assumed complete | Workloads inventoried across infrastructure, SaaS, cloud, identity and remote sites |
| Backup integrity | Copies share fate with production | Separated repositories, immutability, off-site and air-gap patterns: 3-2-1-1-0 |
| Monitoring | Failures found manually, or during the incident | 24/7 job-health monitoring, triage, remediation and reporting |
| Restore confidence | Green job status treated as proof | Onboarding validation plus monthly test restores of real data |
| Cyber recovery | Restore the newest copy and hope | Anomaly checks, clean-point selection, isolated validation, rehearsed playbooks |
| DR execution | A document with no rehearsal | Documented objectives, declaration workflow, recovery order, validation, return to primary |
| Accountability | Reseller, MSP, vendor and customer hand work between queues | One team designs, deploys, operates, tests and coordinates escalation |
07The first 30 days
The first
30 days.
| Phase | What happens | What you hold at the end |
|---|---|---|
| Assess and prioritize | Inventory critical workloads, current protection, repositories, retention, immutability, replication, SaaS and identity coverage, RPO and RTO expectations and existing restore evidence. Rank risks by business impact. | A current-state view, the coverage gaps that matter, and an agreed definition of recovery success. |
| Stabilize and implement | Fix the urgent failures first. Separate backups from production where they share fate, modernize repositories and policies, enable immutable or air-gapped copies, integrate monitoring and ticketing, document recovery workflows. | Critical assets under governed protection, failing jobs remediated, alerting live, ownership clear. |
| Validate and optimize | Run representative restore tests, validate data integrity and application access, measure against objectives, update runbooks, establish reporting and the improvement roadmap. | Documented protection status, tested recovery evidence and an operating cadence. |
Scope control
Thirty days stabilizes and proves the foundation. Appliance procurement, initial data seeding and full DR exercises run on their own timeline; a representative full deployment runs about ninety days from design to go-live.
08Two paths, one team
Engagement
models.
This page is the architect, procure, deploy and validate motion, and it works on platforms we sold or platforms we inherited. The operating layers are productized: BaaS runs the daily discipline, monitored jobs, remediation and monthly test restores. DRaaS proves the bigger claim, that systems, identity, storage and networking can be activated together at a recovery site and returned safely. Same team, and the strongest version of this page's promise.
09Proof
Proven
results.
2,700 identities under protection by design.
A current design for a large law firm protects 2,700 Microsoft 365 and Entra ID users on dedicated appliance clusters, with test restores and 24/7 monitoring built into delivery.
3,900 users, 1,795 VMs, 100 TB of S3, one strategy.
A hybrid protection design scoping Microsoft 365, directory objects, AWS workloads and air-gapped copies under a single operating model.
The assessment that paid for itself.
One infrastructure assessment found most VMs unprotected or failing nightly and satellite sites with no backup at all, and expanded directly into a funded remediation engagement.
10FAQ
Frequently asked
questions.
01 /Does a successful backup job prove we can recover?
No. It proves a task completed. Recovery requires restoring the data, starting the application, confirming dependencies and logging in. That gap is exactly why restores get tested monthly instead of assumed.
02 /Cohesity, Rubrik or Veeam: how do we actually choose?
By operating model, restore targets, existing estate and SaaS or identity coverage requirements, not feature bingo. We run all three and will show you the tradeoffs in your terms.
03 /What does immutable actually mean here?
Hardened repositories, object lock, time-locked snapshots or air-gapped copies, arranged so a compromised admin credential cannot delete the recovery copy. The standard we design to is 3-2-1-1-0, and the zero means zero unverified restores.
04 /How often are restores tested?
Monthly for managed backup, with evidence you can hand an auditor. Full DR exercises are scheduled by workload criticality and scope, from annual to twice yearly.
05 /Does Microsoft 365 need its own backup?
Yes. Retention policies and the recycle bin are not backup, and they do not cover account compromise, malicious deletion or Entra ID itself. Protecting the identity layer is now part of protecting the data.
06 /Can you recover Entra ID and Active Directory?
Yes, protection designs cover users, groups and directory objects alongside the workloads, because servers nobody can log into are not recovered.
07 /After ransomware, how do we avoid restoring the infection?
Anomaly and malware checks on restore points, clean-point selection, and validation in an isolated, non-routable environment before anything rejoins production.
08 /Will you manage backup software we already own?
Yes. The assessment decides whether to optimize, augment or replace what is in place. Plenty of engagements start with your licenses and our discipline.
09 /Should we refresh the backup platform or move to BaaS?
Refresh if protection is core to your team’s job and you want the asset. Subscribe if you want the outcome under SLA without the staffing. We price both side by side.
10 /What is the difference between backup and DR?
Backup creates and validates recoverable data. DR proves that systems, identity, applications, storage and networking activate together at a recovery location, then return to production safely. They are different insurance policies, and most environments need a deliberate mix.
11Direct to an engineer
Tell us about your
recovery posture.
Backup platforms, repositories and the DR plan as it stands. We will map coverage and find the shared blast radius.