Immutable Backup, Air Gap or Recovery Vault: Which Fits?

Three designs are in play. An immutable backup is a copy that nobody can change or delete for a set period. An air gap keeps a copy out of reach of the network. A recovery vault, unlike the other two, is a separate, restricted copy with its own access. In Signisys’ reading, none of them is complete on its own. When an attacker holds admin rights, the choice turns on one question: which copy survives. This guide suits IT heads and IT managers at firms of roughly 250 to 2,000 people in India and the GCC. It compares the three designs on four neutral criteria, then gives a decision rule and a restore test. It names no product. If you need the basics first, read what ransomware is.

Immutable Backup, Air Gap and Recovery Vault in One Line Each

Each design answers one question: who can change the copy, who can reach it, and who holds the keys. While the first two lines below are plain definitions, the third has its own section.

An immutable backup is a copy that nobody can edit, overwrite or delete during a set retention period. Write-once storage or retention settings at the storage layer provide this. The UK’s national cyber security body published the NCSC’s offline-backups post on 13 August 2019. It also describes cloud storage set to accept only new backups or appends, which it calls “comparable to traditional write-once storage”. Also, NIST IR 8374 Rev. 1 (June 2026) is a profile for any organisation regardless of sector or size, and it is not a regulation. It lists storing data in an immutable format among its basic tips. NIST describes this as data that new data does not overwrite automatically.

In this guide, an air gap is a copy with no standing network path to it, whether by physical removal or by digital disconnection. NIST SP 800-209 separates strict air-gapping from less strict forms. Strict means full physical and network-level separation, while less strict forms shut data ports and open them for a limited time. The NCSC also says a cloud copy can serve as an offline backup when it is digitally disconnected between uses.

What a Recovery Vault Is, and Why It Is a Market Term, Not a Standard

“Recovery vault” has no standard definition. It is a market term. The description below is Signisys’ reading of NIST SP 800-209 (October 2020, final), section 4.7 on isolation. That is guidance from a US standards body. It is written for chief security and technology officers and for storage and system administrators.

NIST doesn’t use “vault” as a design name, apart from “vault locking” in one recommendation. It separates recovery from ordinary failures from recovery after a cyber attack. For the second kind, it advises hardening and locking the copies and keeping them in isolation. Read together, recommendations R1, R2, R3, R4 and R7 describe the arrangement vendors call a vault:

• R1: the copy sits in separate storage, or in separate accounts in a public cloud.
• R2: a separate management system holds it, one that regular and backup credentials don’t reach.
• R3: access stays narrow, and item (a), which applies when the information is sensitive, keeps regular IT staff out and limits access to a single person or a very narrow group of executives or security managers on separate credentials.
• R4: the copy stays off-site.
• R7: nobody mounts, exports or maps the copy to hosts, and you restore it onto an isolated staging environment before using it. NIST names limited read-only access during restore as a less secure option.

For critical and sensitive systems, NIST recommends keeping cyber-attack recovery copies completely separate from the copies used for non-malicious recovery, but it does not make that mandatory. If you are weighing a vendor’s “vault” product, check each point against this description and not the name.

One Question: Which Copy Survives When an Attacker Holds Admin Rights?

The #StopRansomware Guide, version 3.0 of October 2023 from CISA, NSA, FBI and MS-ISAC, says ransomware actors attempt to find and then delete or encrypt accessible backups. It also says they hunt for and collect credentials stored in the targeted environment and use them to attempt to reach backup solutions. Its own advice is to maintain offline, encrypted backups of critical data.

The table compares the three designs on the same four criteria. Every criterion and cell here is Signisys’ own reading, and the vault row alone rests on NIST R1 to R3 and R7. Rows for the other two designs rest on no source, and none gives a restore figure.

When you read the table, start with the third column. A design is only as strong as its weakest open point.

What an Immutable Backup Does Not Stop

An immutable copy resists change, not exposure. CISA’s guide says to use immutable storage “with caution”: it does not meet compliance criteria for certain regulations, and misconfiguration can impose significant cost. CISA does not say to avoid it. The same guide notes that some cloud vendors offer immutable storage that can protect stored data “without the need for a separate environment”.

Three points stay open, and they are Signisys’ reading:

• The copy is still within network reach, and an attacker with the right credentials can see it.
• The lock is only as strong as the people who can shorten or remove it.
• If the retention period is shorter than the time an attacker may sit unnoticed, the clean copy may have expired by the time you need it. The firm sets the period, and this guide gives no figure.

NIST SP 800-209 (recommendation IS-SS-R10) also says to “consider” immutable storage, with retention locking, vault locking and immutability policies as examples, as a way that could help further isolate and protect recovery data, though it is not a requirement. The NCSC post says of the 3-2-1 rule that it “does not require any backup location to be offline”. Following that rule alone doesn’t give you an offline copy.

Air Gap and Recovery Vault: What You Trade for Isolation

In Signisys’ reading, more isolation adds restore steps and effort. An immutable backup that stays online adds no such step. NIST SP 800-209 (IS-SS-R8) says organisations should “consider” an air gap around the cyber-attack recovery copies of sensitive data. It adds that you should weigh strict and less strict techniques against the value of the data and the adversary’s ability. The reader sets the threshold.

For a digital air gap, the NCSC post describes storage that allows only authorised clients to create new backups or append to existing ones. That storage denies connection requests while it is not in use (“cold”). It also says cloud backup clients should not hold valid credentials while the storage is not in use. It adds that you should keep the number of backup clients to a minimum.

A vault works only if its points hold. NIST’s description does not count a vault that shares a login, an account or a console with production as isolated. When restore goes to an isolated area first (IS-SS-R7), it adds a step compared with restoring in place.

A physical copy also needs media handling. That effort is real, and a copy you do not rotate falls out of date.

How to Choose an Immutable Backup, Air Gap or Vault

The order below is Signisys’ own decision rule. Follow the steps in order. “Use all of them” is a fair end state, but it doesn’t say what to start with. The steps below are how to get there. The page on the backups attackers can’t touch shows how Signisys approaches the topic.

1. Name the copy that an attacker with admin rights on production and on the backup console could still change. If every copy is in that reach, the first fix is separation of access, not a new product.
2. Put one copy under separate credentials and separate storage, following the vault description above.
3. Make that copy immutable for a retention period the firm sets, if the storage supports it, and check the lock settings with CISA’s caution in mind.
4. Add a disconnected or removed copy when the value of the data and the likely adversary justify the slower restore.

When One Design Is Enough, and When to Layer

If a small team has one site and one cloud account, it can start with a separated, immutable cloud copy and test it. A firm that holds data whose loss would be severe adds an air-gapped or removed copy on top. NIST ties the air-gap choice to the value of the data and the adversary. Whether a small firm can stay with one design is Signisys’ reading, and it is not a product pick.

Ask a specialist when the team can’t say who holds the keys to each copy, or when a regulator’s retention rule applies. Check the rule with your compliance adviser. This guide makes no claim about Indian or GCC rules.

Test the Choice With One Restore

A design is only proven when a restore works. This test is Signisys’ own, and it is separate from a scored checklist.

1. Pick one named business system.
2. Restore it from the protected copy, using an account that no everyday administrator holds.
3. Have a business user open the result before you sign it off.
4. Record the time taken and anything that was missing.
5. Repeat the test whenever retention, access or storage changes.

NIST SP 800-209 (section 4.8) says organisations should verify that they protect all components of critical data assets and can restore them faithfully, consistently and completely. CISA’s guide also says to regularly test the availability and integrity of backups in a disaster recovery scenario.

In Signisys’ reading, a failed test can point to a gap such as these three. The copy may be out of reach of the people who need it. Alternatively, the lock or isolation may have blocked a legitimate restore, or the data may not be usable. Fix that gap before adding a second design. For the wider picture, see why a restore fails.

What This Guide Does Not Cover

This guide names no product or vendor and ranks none. Other guides in this set cover why recovery fails, the prevention steps and a scored checklist. It does not set retention periods or restore objectives for you. This guide is general information, not legal advice, and it makes no claim about India or GCC rules. Signisys provides data protection and cybersecurity services, and this guide says so here and in the box below.

Signisys provides data protection and cybersecurity services for growing firms, including backup and immutable copies. Our Data Protection, Backup and Cyber Recovery solution and our Cybersecurity Services page set this out. The decisions on each copy stay with your own team.

Immutable Backup FAQ