Back to Blog
    air-gapped-backups
    data-protection-strategies
    secure-backup-solutions
    protect-backups-from-ransomware
    benefits-of-air-gapped-backups

    Air-Gapped Backups for SMBs: Verify Restores Before Ransomware Hits

    Dustin CollettOctober 13, 2026

    An air-gapped backup is a copy of your data that has no standing, automatic path back to your production systems, kept isolated through physical disconnection or strict logical controls. That isolation is what preserves at least one clean, recoverable copy when ransomware reaches every backup it can touch. Most organizations run some mix of physical and logical air gaps, often alongside immutable storage, to cover different recovery scenarios.

    TL;DR:

    • Pair a fast logical copy with a physically disconnected fallback; physical retrieval can add hours or days, while logical restores depend on identity controls.
    • Keep backup identities separate from production, use pull based replication, and apply retention locks to reachable cloud copies to limit ransomware access and deletion.
    • Maintain three copies across two media types, with one off site and one immutable or isolated, then verify zero recovery errors through restore tests.
    • Test critical systems at least quarterly and after major infrastructure changes, restoring data in isolation and checking recovery time against documented targets.
    • For physical media, assign named custodians, log every handoff, store copies off site, and follow a fixed rotation schedule with documented retrieval procedures.

    Table of Contents

    What Are Air-Gapped Backups and What Types Exist?

    NIST defines an air gap as an interface between systems that are not physically connected, where data crosses only manually and under human control. That definition still anchors the term, but practice has split into two distinct models that behave very differently during an incident.

    A physical air gap means the backup media has no electronic connection to production at all. Someone has to carry it, load it, or power it on. A logical air gap keeps data reachable over a network but blocks unauthorized access through separate identity domains, restricted credentials, and controls like object lock. It trades some of the physical gap's certainty for faster recovery and less manual handling.

    Common implementations include:

    • Physical: tape vaulted off-site, removable drives rotated out of the building, disk arrays powered down between backup windows.
    • Logical: a separate cloud tenant with independent identity and billing, pull-only replication where the backup account retrieves data rather than production pushing it, and object storage with retention locks that block deletion even by an administrator.
    • Hybrid: a logically isolated primary copy for fast recovery, paired with a periodic physical export for the worst-case scenario.

    Hybrid patterns have become common because they solve a real problem: a pure physical air gap recovers slowly, and a pure logical gap depends entirely on how well identity and access controls are configured. In a hybrid setup, "air gap" usually means the logical layer handles day-to-day protection while the physical layer serves as the final, truly disconnected fallback. NIST's own guidance acknowledges this tradeoff directly: physical gaps are stronger but costlier, while logical gaps offer automation and faster recovery at the cost of depending on configuration discipline.

    For organizations building a cloud-first logical air gap, NIST's glossary notes specific controls worth enforcing: separate accounts or tenants with independent identity and billing, strict IAM separation between production and backup roles, and pull-based ingestion so the backup side initiates the connection instead of production pushing data outward.

    Why Air-Gapped Backups Matter Now for Ransomware Protection

    Modern ransomware operators do not just encrypt production data. They actively hunt for backup infrastructure and the credentials that protect it, because a usable backup is the one thing that lets a victim refuse to pay. The CISA StopRansomware Guide directs organizations to maintain offline, encrypted backups and test restoration regularly, precisely because attackers look for ways to remove that option before triggering encryption.

    This is where network-connected backups fail quietly. Cloud sync tools and mounted network drives often replicate changes automatically, which means an encryption event on production can propagate straight into the backup set before anyone notices. A backup that is technically "backed up" but still reachable from a compromised identity is not meaningfully different from production, from an attacker's perspective.

    • Attackers target backup servers and credentials as a first move, not an afterthought.
    • Automatic sync and always-mounted backup drives can carry encryption or deletion into your recovery copies.
    • An isolated copy, properly verified, removes the leverage ransomware depends on.

    Automated cloud backups can propagate encrypted files when local files are encrypted, which is why CISA and sector guidance recommend offline or logically isolated copies with object lock or versioning as a mitigation. When that isolated copy is in proper custody and its integrity is verified before a restore, it becomes the difference between a bad week and a ransom negotiation.

    Air-Gapped Backups vs. Immutable Backups: Complementary Defenses

    Air gaps and immutable storage solve different problems, and conflating them leads to gaps in coverage. An air gap is about isolation: nothing can reach the copy without a deliberate, often manual, action. Immutability is about write protection: the copy can be reached, but it cannot be altered or deleted for a defined retention window, even by someone with valid credentials.

    Each has a failure mode the other doesn't share. An air-gapped copy can still be destroyed if an attacker (or a careless administrator) gets physical or logical access during the narrow window when it's connected for writing. An immutable copy can still be exposed to compaction bugs, misconfigured retention policies, or a provider-side failure, because it remains technically reachable at all times.

    • Immutability protects against tampering and deletion while the copy stays online and fast to restore from.
    • Air gaps protect against total compromise, including scenarios where an attacker has full administrative control of your identity provider.
    • Layering both means an attacker has to defeat two different kinds of defense, not just one.

    Our immutable backups guide goes deeper on how write-protection works day to day, but the practical rule is simple: use immutability as your default protection for fast-recovery copies, and add a true air gap, physical or logical, for the copy you'd fall back to if your entire cloud identity were compromised. Relying on immutability alone leaves you exposed to the identity-layer attacks CISA has flagged as increasingly common.

    Design Patterns: Physical, Logical, and Hybrid Air-Gap Architectures

    Choosing an architecture comes down to how fast you need to recover and how much manual handling your team can sustain. Here's how the three patterns typically play out:

    1. Physical air gap. Tape remains the classic example: media is written during a defined window, then physically removed and vaulted off-site under documented custody. Retrieval means someone has to drive to the vault, sign for the media, and load it, which adds hours or days to recovery but guarantees the copy was never reachable outside its write window. A practical test for whether your gap is real: can you name a single person or credential that could destroy both the production copy and the backup copy? If yes, you don't have a true gap, according to a practitioner analysis of air-gap duty cycles.
    2. Logical air gap. A separate cloud tenant, isolated identity provider, and pull-only replication keep the backup copy reachable in minutes rather than hours. The tradeoff is that your isolation is only as strong as your access control configuration, which is why strict IAM separation and independent credentials matter more here than almost anywhere else in the stack.
    3. Hybrid architecture. Many mid-sized organizations run a logical air gap for the copies they'd restore from on a normal Tuesday, with a periodic physical export (monthly or quarterly) as the true last resort. This reduces the operational friction of physical media rotation while still keeping one copy that no network event can reach.

    Regulated industries handling health records or financial data often lean toward the physical or hybrid model because auditors expect a demonstrably disconnected copy. Large cloud-first estates tend to favor logical air gaps because physical media doesn't scale well across dozens of workloads. Small and mid-sized businesses with a single site often get the most value from a hybrid pattern: a logical gap for daily resilience, and a small rotation of physical media for the scenario where the whole cloud environment is compromised at once. TechTarget's overview of air-gap tradeoffs echoes this split, noting that finance, healthcare, and research environments weigh security gains against the retrieval delays that come with manual handling.

    Whichever pattern you choose, the decision should map to the workloads that actually need it. Line-of-business file shares might tolerate a logical gap and a same-day restore. Core financial systems, patient records, or anything with regulatory retention requirements usually justify the added friction of a physical or hybrid copy.

    Implementing an Air-Gap Strategy: Checklist and Restore Verification

    Most teams already run some version of backup rotation. The work is tightening it into something that actually survives a ransomware event, not just a hardware failure.

    Start with 3-2-1-1-0

    The 3-2-1-1-0 rule extends the familiar 3-2-1 approach: three copies of your data, on two different types of media, with one copy off-site, plus one copy that is immutable or air-gapped, and zero recovery errors confirmed through regular automated restore testing. The "zero" is the part most organizations skip, and it's the part that actually proves the strategy works. Our earlier piece on the 3-2-1 rule covers the base framework if you're still building out your first three copies.

    Build the checklist

    1. Encrypt data at rest and in transit for every copy, including the air-gapped one.
    2. Use separate credentials for backup systems, never shared with production administrative accounts.
    3. Enable object lock or retention policies on any logical copy that stays network-reachable.
    4. Document offline media procedures: who pulls media, who signs for it, where it's stored, and who can authorize retrieval.
    5. Keep golden images and infrastructure-as-code templates offline, alongside your data backups, so rebuilding a server doesn't stall on a missing installer or license key.
    6. Maintain a media inventory and chain-of-custody log for every physical copy currently in rotation.
    7. Automate what's repeatable (encryption, replication triggers, integrity checks) and keep humans in the loop for anything that finalizes the isolation, like disconnecting a drive or vaulting tape.

    CISA's guidance specifically calls out golden images and IaC templates as recovery accelerants, because rebuilding infrastructure from scratch during an incident is often slower than restoring the data itself.

    Test restores like you mean it

    A backup you haven't restored is a theory, not a plan. Testing guidance under the 3-2-1-1-0 model sets the bar at zero recovery errors, verified through restores that run on a defined schedule rather than whenever someone remembers.

    • Test at least quarterly for critical systems, and after any significant infrastructure change.
    • Restore to an isolated environment, not production, to confirm both data integrity and that the restore process itself works end to end.
    • Track time-to-restore alongside error rate: a backup that technically restores but takes three days longer than your recovery window needs a different architecture, not just a passing grade.
    • Document every test, including failures, because the failures are what tell you where the plan breaks.

    Pro Tip: Run your first full restore test on a Friday afternoon, not a Tuesday morning. If your documented process survives when half the team is unreachable, it will survive a real incident too.

    Our disaster recovery testing guide breaks this process down further, including what acceptance criteria to set for different workload tiers. The decision of what to automate versus what to keep manual usually comes down to risk: automate the parts of the process that reduce human error, and keep a person in the loop for anything that could be exploited if automated, like credential rotation or final media disconnection, following a comprehensive OpenAI enterprise security checklist to guide these controls.

    Operational Tradeoffs: RTO, Human Processes, and Maintenance

    Air-gapped backups buy security at the cost of operational complexity, and it's worth being honest about where that cost shows up.

    Recovery time is the most visible tradeoff. A physical air gap can add hours to days to your recovery time objective, since someone has to physically retrieve and load media. Logical air gaps recover far faster, often within the same window as a standard restore, but depend entirely on your identity and access controls holding up. Most teams keep a fast logical copy for routine recovery and treat the physical copy as the fallback for a worst-case scenario, not the first thing they reach for.

    Human processes introduce their own risk. A mislabeled tape, a custody log that wasn't updated, or a key person being unavailable during an incident can turn a solid architecture into a slow one. These aren't theoretical: a practitioner lesson on air-gap duty cycles describes a physical air gap as exactly that, a duty cycle, not a permanent state, since media is briefly exposed while being written and has to be deliberately severed afterward.

    • Media compatibility drifts over time: hardware that reads a five-year-old tape format may not exist anymore.
    • Patching disconnected systems requires a deliberate process, since they don't receive routine updates.
    • Retention windows on immutable storage can create their own traps, including compaction behavior that needs a documented rollback procedure.

    Pro Tip: Build your restore test calendar around your incident response plan, not separately from it, so the same muscle memory applies whether you're testing or recovering for real.

    Governance matters as much as the technical setup. Document every restore test, log every custody handoff, and feed lessons learned back into your incident response plan rather than filing them away.

    Our Approach to Air-Gapped Resilience for SMB Clients

    We build air-gapped resilience into managed backup and disaster recovery the same way we build everything else: as a standard part of the stack, not an upsell. For clients on Managed IT Services, that means a defined runbook covering custody, rotation, and restore verification, with clear ownership at every step.

    • A named rotation schedule for offline media, with sign-off logged at pickup and return.
    • Scheduled restore tests with documented pass or fail results, reported back to the client.
    • Golden images and configuration templates kept current and stored alongside backup data.

    Continuous monitoring and restore testing can provide faster effective recovery time without giving up the isolated copy that protects if everything else fails. Our guide to managed backup and disaster recovery covers how this runbook fits into a broader DR plan, and our piece on why ransomware recovery is a process explains why the backup itself is only one piece of actually getting back online.

    Compliance Considerations for Air-Gapped Backups

    Regulatory frameworks rarely mandate the specific term "air gap," but many effectively require what it delivers: a verifiably isolated, tamper-resistant recovery copy. Healthcare organizations subject to HIPAA, financial institutions under GLBA, and government contractors working under CJIS all face audit expectations around backup integrity, retention, and demonstrable recovery capability.

    The FTC's guidance for small businesses recommends offline, off-site, encrypted backups as a baseline preventive step, and treats CISA's ransomware resources as required reading for any technical team responsible for compliance posture. That's a useful floor even for organizations without a formal regulatory mandate, since insurers and auditors increasingly ask for the same evidence.

    What auditors typically want to see is not just that backups exist, but that they're tested, logged, and recoverable within a documented timeframe. A chain-of-custody log for physical media, a restore test schedule with pass or fail outcomes, and documented retention policies on immutable storage all serve double duty: they satisfy compliance requirements and they're exactly the evidence you'd want during an actual incident. Organizations working with government data should also confirm their backup architecture aligns with any CJIS-specific handling requirements before treating a generic backup policy as sufficient.

    Automation Tools That Support Air-Gapped Backup Management

    Automation reduces the human error that undermines otherwise sound air-gap architectures, but it has to be applied selectively. Backup orchestration platforms can schedule replication to a logically isolated tenant, trigger integrity checks after each write, and alert on failed jobs before they become a surprise during an incident.

    Object storage platforms with built-in retention locking handle the immutability side without manual intervention, which pairs well with a logical air gap that uses pull-only replication. Infrastructure-as-code tools help maintain current golden images automatically, so the offline rebuild templates CISA recommends don't quietly go stale between update cycles.

    Where automation should stop is at the final isolation step itself. Automatically severing a physical connection or finalizing a media rotation removes the human judgment that makes an air gap meaningful in the first place; if a script can disconnect the backup, an attacker's script potentially can too. The practical pattern is automating everything up to and including the integrity check, then requiring a deliberate human action to complete the isolation.

    Common Challenges When Implementing Air-Gapped Backups

    The most common failure isn't technical, it's organizational drift. A rotation schedule gets documented once and then slips as staff change, and nobody notices until a restore is needed.

    • Credential overlap: backup accounts that share privileges with production admin accounts defeat the purpose of a logical air gap.
    • Stale documentation: custody logs and media inventories that aren't updated in real time become unreliable exactly when they matter most.
    • Media degradation: physical media has a shelf life, and hardware to read older formats doesn't last forever.
    • Underestimated RTO: teams discover during a real incident, not a test, that physical retrieval takes longer than anyone planned for.

    The fix for most of these is the same: treat restore testing as the mechanism that surfaces problems before an attacker does. A quarterly test that fails because nobody could find the tape is a far better outcome than discovering that during an actual ransomware event. Teams that struggle with consistency often benefit from handing the rotation and testing cadence to a managed provider, simply because it removes the dependency on any one person remembering to do it.

    Fitting Air-Gapped Backups into Your Disaster Recovery Plan

    An air-gapped copy is one component of recovery, not the whole plan. It needs to sit inside a broader disaster recovery and business continuity framework that defines recovery time objectives, recovery point objectives, and the order in which systems come back online.

    That framework should specify which workloads get a fast logical-gap restore and which depend on the slower physical fallback, so recovery priorities are decided in advance rather than improvised during an incident. It should also tie directly into incident response: the moment ransomware is detected, the plan should name who verifies backup integrity, who authorizes a restore, and who documents the timeline for later review.

    Business continuity planning also means accounting for what happens between detection and full recovery, including temporary operations, communication with stakeholders, and any regulatory notification requirements. Our perspective on ransomware recovery as a process goes further into why treating backups as a standalone product, rather than one piece of a tested plan, tends to leave organizations exposed exactly when they need the plan most.

    Best Practices for Managing and Rotating Offline Backup Media

    Offline media is only as good as the discipline around it. A tape sitting in the wrong drawer is functionally no safer than a backup nobody took.

    • Label every piece of media with creation date, retention period, and content summary, and keep that log separate from the media itself.
    • Rotate on a fixed schedule, not an ad hoc one, so gaps in coverage are visible immediately rather than discovered during a crisis.
    • Store off-site, in a facility with controlled access and environmental protection against heat, humidity, and physical damage.
    • Limit custody to named individuals, and log every handoff, pickup, and return.
    • Retire media on a defined cycle before hardware compatibility or physical degradation puts data at risk.

    Our backup best practices guide covers the broader hygiene checklist this fits into, including how rotation schedules should align with your retention requirements. The goal is a system where anyone on the team can answer, at any moment, exactly which copy is currently in custody, where it physically sits, and when it was last verified.

    Priorities for IT Leaders Moving Forward

    If you take one thing from this, make it restore verification. An isolated copy you've never tested is a guess, not a recovery plan. Prioritize isolation first, then build a testing cadence rigorous enough to catch failures before ransomware does.

    Balance recovery speed against isolation deliberately rather than by default: keep a fast logical copy for routine use and a genuinely disconnected copy for the worst case, with a tested golden-image rebuild path behind both. If your team doesn't have the bandwidth to maintain that discipline internally, a managed assessment is a reasonable way to close the gap without guessing at where you stand.

    , Dustin Collett

    Get a Clear Picture of Your Backup Readiness

    If you're not sure whether your current backups would actually survive a ransomware event, that uncertainty is the problem worth solving first. Our IT & Security Assessment maps directly to the checklist above: credential separation, encryption, offline media handling, golden image currency, and a realistic look at your current restore success rate.

    Collett Systems LLC

    For clients who want us to take it further, Managed IT Services and Total Secure put custody, rotation, automation, and quarterly restore testing on our side of the fence, with fixed per-user pricing and no surprise add-ons for the work that actually keeps your recovery plan honest. Start with the assessment and we'll show you exactly where your current setup stands.

    FAQ

    Is air gap security still relevant?

    Yes. CISA's current ransomware guidance continues to recommend offline, encrypted backups as a core defense, because attackers routinely target connected backup infrastructure first. Logical air gaps have made the approach more practical for cloud-first environments without reducing its relevance.

    What are the four types of backups?

    Backup strategies commonly combine full, incremental, differential, and synthetic full backups, each differing in how much data is captured and how fast a restore runs. The right mix depends on your recovery point objectives and how much storage and bandwidth you can dedicate to backup jobs.

    What is the 3-2-1-1-0 rule for backing up?

    The 3-2-1-1-0 rule extends the classic 3-2-1 approach: three copies of your data, on two types of media, with one off-site, plus one copy that's immutable or air-gapped, and zero recovery errors confirmed through regular restore testing. The "zero" requirement is what turns a backup policy into a verified recovery plan.

    What does air gap mean in cyber security?

    An air gap, as defined by NIST, is an interface between systems that are not physically connected, where data transfers only manually and under human control. In practice, the term now covers both true physical separation and logical isolation enforced through separate identities and restricted access controls.

    Sources