CIO / VP of IT
Recoverability evidence and executive reporting, with one accountable partner across the lifecycle.
Protect · Platforms we sell and architect
Data Protection & Cyber Recovery.
In the environments we assess, backups are nearly universal and recovery evidence is rare. ModernOps designs protection around the restore, separates it from the production blast radius, monitors it around the clock and tests it monthly.
CISO / Risk Leader
Ransomware-resistant copies, reduced blast radius, clean-point recovery and continuously validated readiness.
Data Protection Lead
One coherent architecture across backup platforms, repositories, replication, SaaS and cloud, with RPO and RTO targets the design can meet.
Operations / Continuity Lead
Monitored jobs, ticket-driven remediation, declaration procedures and post-test action tracking.
The decision
Key design
considerations.
01 /
Backup software or backup outcome.
Refresh the platform you operate, or subscribe to BaaS and make restore success part of a contracted SLA. The answer depends on your team's capacity more than on the product.
02 /
A green job status proves little.
A green checkmark proves a task completed. Recoverability requires restoring the data, starting the application and confirming someone can log in, which is why restore validation runs monthly here rather than once a year.
03 /
One blast radius.
Backups that share storage, credentials or network fate with production die with production. The design standard is 3-2-1-1-0: separated repositories, an off-site copy, an immutable or air-gapped copy, and zero unverified restores.
04 /
Identity is in the blast radius now.
Microsoft 365, Entra ID and Active Directory are production systems. A restored server is of no use until people can sign in to it, so identity comes back first, which is how our recovery playbook sequences it.
05 /
The newest copy may carry the infection.
Restoring the latest backup after ransomware often restores the ransomware. Clean recovery means anomaly and malware checks, clean-point selection and validation in an isolated environment before anything touches production.
What we architect
Reference
architectures.
Pattern 01
Scale-out appliance clusters replacing aging purpose-built backup hardware, with retention lock, replication between sites and capacity sized for growth instead of last cycle’s estate.
Pattern 02
Greenfield rollouts consolidating fragmented job-level tooling into policy-driven protection, with onboarding restore validation before go-live.
Pattern 03
Upgrades, hardened repositories and immutable object targets for the backup platform you already run, built to the 3-2-1-1-0 standard.
Pattern 04
Exchange, Teams, SharePoint and OneDrive plus Entra ID and AD objects, protected as first-class workloads. One current design protects 2,700 Microsoft 365 and Entra ID users on dedicated appliances; another scopes roughly 3,900 users, 10,000 directory objects, 1,795 VMs and 100 TB of object storage under one hybrid strategy.
Pattern 05
Continuous replication for the workloads where minutes of data loss are unacceptable, tiered above standard backup and wired into declaration and failback procedures.
Pattern 06
Cyber recovery as an executable workflow: clean-point identification, isolated and non-routable recovery environments, sequenced restoration starting with identity, customer validation gates, and return-to-primary planning. The public version of this thinking is Field Note 02.
The platforms
Supported
platforms.
Platform projects, upgrades and renewals for teams standardizing on policy-driven protection with strong cyber-recovery tooling.
Scale-out appliance clusters, refreshes and multi-year coterm structuring, extended into Microsoft 365 and Entra ID protection designs. The current standardization target for combined data center, SaaS and identity coverage.
Renewals, upgrades and coverage consolidation for the estates with the most to protect: databases, NAS, virtualization and SaaS under one policy engine. The established fit where audit and compliance requirements drive the architecture, with air-gapped and immutable copies built into the design.
Renewals, upgrades and hardened-repository designs for the backup platform we encounter most often in mid-market estates, plus immutable object targets and 3-2-1-1-0 alignment. Veeam is also an engine behind ModernOps BaaS, so we operate it daily under an SLA as well as quoting it.
Continuous replication as the low-RPO tier in a protection architecture: licensing, migrations and renewals, positioned above backup for the workloads where an afternoon of lost data is unacceptable.
Also on the line card
NAKIVO (a hosted BaaS engine alongside Veeam), AFI for SaaS protection, Object First hardened targets, and storage-native protection covered on the Enterprise Storage page.
The old model vs ModernOps
The ModernOps
difference.
| Dimension | The old model | ModernOps |
|---|---|---|
| Protection scope | Inherited jobs, assumed complete | Workloads inventoried across infrastructure, SaaS, cloud, identity and remote sites |
| Backup integrity | Copies share fate with production | Separated repositories, immutability, off-site and air-gap patterns: 3-2-1-1-0 |
| Monitoring | Failures found manually, or during the incident | 24/7 job-health monitoring, triage, remediation and reporting |
| Restore confidence | Green job status treated as proof | Onboarding validation plus monthly test restores of real data |
| Cyber recovery | Restore the newest copy and hope | Anomaly checks, clean-point selection, isolated validation, rehearsed playbooks |
| DR execution | A document with no rehearsal | Documented objectives, declaration workflow, recovery order, validation, return to primary |
| Accountability | Reseller, MSP, vendor and customer hand work between queues | One team designs, deploys, operates, tests and coordinates escalation |
The first 30 days
The first
30 days.
| Phase | What happens | What you hold at the end |
|---|---|---|
| Assess and prioritize | Inventory critical workloads, current protection, repositories, retention, immutability, replication, SaaS and identity coverage, RPO and RTO expectations and existing restore evidence. Rank risks by business impact. | A current-state view, the coverage shortfalls that matter, and an agreed definition of recovery success. |
| Stabilize and implement | Fix the urgent failures first. Separate backups from production where they share fate, modernize repositories and policies, enable immutable or air-gapped copies, integrate monitoring and ticketing, document recovery workflows. | Critical assets under governed protection, failing jobs remediated, alerting live, ownership clear. |
| Validate and optimize | Run representative restore tests, validate data integrity and application access, measure against objectives, update runbooks, establish reporting and the improvement roadmap. | Documented protection status, tested recovery evidence and an operating cadence. |
Scope control
Thirty days stabilizes and proves the foundation. Appliance procurement, initial data seeding and full DR exercises run on their own timeline; a representative full deployment runs about ninety days from design to go-live.
Platform or managed service
Engagement
models.
This page covers the architect, procure, deploy and validate work, on platforms we sold or platforms we inherited. The operating layers are productized: BaaS runs the daily discipline of monitored jobs, remediation and monthly test restores, and DRaaS proves the larger claim that systems, identity, storage and networking can be activated together at a recovery site and returned safely. The same team delivers both.
Proof
Recent
engagements.
2,700 identities under protection by design.
A current design for a large law firm protects 2,700 Microsoft 365 and Entra ID users on dedicated appliance clusters, with test restores and 24/7 monitoring built into delivery.
3,900 users, 1,795 VMs, 100 TB of S3, one strategy.
A hybrid protection design scoping Microsoft 365, directory objects, AWS workloads and air-gapped copies under a single operating model.
The assessment that paid for itself.
One infrastructure assessment found the majority of VMs either unprotected or failing nightly, and satellite sites with no backup at all. It expanded directly into a funded remediation engagement.
FAQ
Frequently asked
questions.
01 /Does a successful backup job prove we can recover?
No. It proves a task completed. Recovery requires restoring the data, starting the application, confirming dependencies and logging in, which is why restores are tested monthly here.
02 /Cohesity, Rubrik or Veeam: how do we choose?
By operating model, restore targets, existing estate and SaaS or identity coverage requirements. We run all three and will show you the tradeoffs in your terms.
03 /What does immutable mean here?
Hardened repositories, object lock, time-locked snapshots or air-gapped copies, arranged so that even a compromised admin credential lacks the authority to delete the recovery copy. The standard we design to is 3-2-1-1-0, and the zero means zero unverified restores.
04 /How often are restores tested?
Monthly for managed backup, with evidence you can hand an auditor. Full DR exercises are scheduled by workload criticality and scope, from annual to twice yearly.
05 /Does Microsoft 365 need its own backup?
Yes. Retention policies and the recycle bin fall short of a backup: they offer no protection against account compromise, malicious deletion or the loss of Entra ID itself. Protecting the identity layer is now part of protecting the data.
06 /Can you recover Entra ID and Active Directory?
Yes. Protection designs cover users, groups and directory objects alongside the workloads, because restored servers sit idle while the directory is still down.
07 /After ransomware, how do we avoid restoring the infection?
Anomaly and malware checks on restore points, clean-point selection, and validation in an isolated, non-routable environment before anything rejoins production.
08 /Will you manage backup software we already own?
Yes. The assessment decides whether to optimize, augment or replace what is in place. Plenty of engagements start with your licenses and our discipline.
09 /Should we refresh the backup platform or move to BaaS?
Refresh if protection is core to your team’s job and you want the asset. Subscribe if you want the outcome under SLA without the staffing. We price both side by side.
10 /What is the difference between backup and DR?
Backup creates and validates recoverable data. DR proves that systems, identity, applications, storage and networking activate together at a recovery location, then return to production safely. They cover different failure modes, and the environments we design carry a deliberate mix of both.
Direct to an engineer
Tell us about your
recovery posture.
Backup platforms, repositories and the DR plan as it stands. We will map coverage and find the shared blast radius.