Air-Gapped Backup

An air-gapped backup provides separation between production systems and a recovery copy. A classic physical air gap is an offline drive or removable medium stored disconnected from the network. Some backup products use logically isolated or tightly restricted storage; those arrangements can offer protection but should not automatically be described as physically air-gapped. The question is whether a compromised production account can reach, alter, or delete the recovery data.

This matters during ransomware incidents because attackers often search for accessible backups and try to encrypt or destroy them. Keep appropriate offline or immutable copies, protect backup credentials, and test whether the organization can restore real systems within acceptable time and data-loss limits. An air gap by itself cannot prove that the backup is complete, current, or free from malicious data.

Air-gapped backup is one protective design within a broader backup and disaster-recovery plan. The organization must still define retention, offsite protection, physical handling, restoration responsibilities, and periodic exercises. It differs from an ordinary continuously synchronized backup, which may replicate an accidental deletion or compromise.