Resilient Data: Architecting a 3-2-1-1 Backup Strategy for MSPs

Mon, 05 Jan 2026 10:00:00 +0000

In modern infrastructure, “Backup” is not a task—it is a foundational pillar of security. For an MSP managing hundreds of endpoints, a simple file-copy isn’t enough. Here is how I architect systems to survive ransomware and site-wide disasters.

1. The 3-2-1-1 Framework

I advocate for an evolved version of the classic 3-2-1 rule, specifically designed for remote-first workforces:

3 Copies of Data: Primary, local secondary, and offsite tertiary.
2 Different Media: Utilizing localized NAS storage for fast LAN recovery and cloud-native repositories.
1 Offsite Location: Ensuring data is physically separated from the primary site.
1 Immutable Copy: Utilizing S3 Object Lock or Air-gapping to ensure backups cannot be deleted by compromised credentials.

2. The Infrastructure Stack

My preferred approach utilizes a unified management plane to reduce “Shadow Data”:

Backup on Alfred van Ster

Resilient Data: Architecting a 3-2-1-1 Backup Strategy for MSPs

1. The 3-2-1-1 Framework

2. The Infrastructure Stack