--- title: "Cyber Insurance and the 3-2-1-1-0 Rule | Firevault" url: https://fire-vault.com/compliance/cyber-insurance-3-2-1-0 description: "Meet cyber insurer expectations by adding a physically disconnected Firevault as the '0' in a 3-2-1-1-0 backup posture." lang: en-GB --- Compliance, Cyber Insurance # 3-2-1-0 Backup, The Insurer Standard Cyber insurers now expect a real offline copy. Firevault Bunkers deliver the 0 in 3-2-1-0 with the audit trail underwriters want to see. - Offline by default - Identity locked access - Hardware encrypted Framework matrix: https://fire-vault.com/compliance/frameworks Image: Security analyst reviewing an isolated workstation with disconnected cables (https://fire-vault.com/assets/hero-square-analyst-DI5B7V_E.jpg) 3 Copies: production plus two protective copies 2 Different media, to avoid correlated failure 1 Offsite copy, physically separated from production 0 Errors on restore, and zero online copies 01 The requirement ## What 3-2-1-0 Actually Means A plain English breakdown of the rule insurers, regulators and boards keep referencing. Wording from underwriters such as Lloyd's syndicates, Beazley and AXA now references offline, immutable or air gapped backup as a control. This is a mapping, not a certification claim. Firevault holds Cyber Essentials Plus. Everything else on this page is stated as alignment: Offline Secure Storage® produces evidence you can point at in your own submission, assessment or audit. 02 What is tested ## The Rule, Line by Line Each line below is something an assessor, regulator or underwriter can ask you to evidence. Three copies: one copy alone is not resilience, it is hope Two media: a single firmware bug should not take both backups One offsite copy with documented chain of custody Zero verified errors, evidenced by regular test restores Zero copies reachable from production at the time of an attack 03 Consequences ## Where Strategies Fall Short What happens when the control is missing, and the record cannot be produced. ### Same Media Twice Both backups on one storage technology means one vendor incident can take both. ### Cold Cloud Is Still Online Glacier and similar tiers stay addressable through the cloud control plane and IAM. ### Untested Restores Insurers increasingly ask for documented test dates, scope and outcome. ### Egress and Handling Cost Per gigabyte retrieval fees and tape handling overhead both bite at the worst moment. 04 The architecture ## Tape, Cold Cloud, or Bunker The three credible ways to satisfy the offline copy requirement, and where each one wins or loses. ### Iron Mountain Tape A genuine physical air gap. The tradeoff is operational: recoveries can take days, handling errors are common and verifying restores at scale is painful. ### AWS Glacier and Cold Cloud Still reachable through the public cloud control plane. Retrieval is slower and cheaper than hot storage, but the data remains addressable and IAM dependent. ### Firevault Bunkers A tape style physical air gap with scheduled, identity verified online windows for restores. CNI-grade bunkers and no per gigabyte egress to budget around. ### Layer 1 Disconnection Between sessions the drives have no network connection, so the offline copy survives a complete production or cloud account compromise. ### Underwriter Evidence Pack A control attestation pack covering Layer 1 disconnection, identity verified access, audit trails and bunker physical security, written to hand to brokers. ### Documented Custody Geographic separation with a recorded chain of custody and verified retrieval for every session. “The 0 in 3-2-1-0 is the only part of the rule an attacker cannot argue with. A copy with no network connection is not a policy, it is a fact.” Mark Fermor, Founder, Firevault 05 What sits offline ## What the Offline Copy Holds The records most often moved into Offline Secure Storage® for this framework. Gold copies of production systems Backup catalogues and recovery keys Regulated records under retention duties Finance and payroll archives Restore test evidence for underwriters Board and audit reporting packs ### Do insurers really require an offline copy? An increasing share do, particularly in mid market and enterprise lines. Premiums and coverage scope are routinely linked to evidence of these controls. ### Where the 0 comes from The 0 has two readings and Firevault recommends covering both: zero errors during restore testing, and zero copies reachable from the production network during an attack. ### Is cloud immutability enough? It is a strong layer, not a complete one. Cloud immutability still depends on identity, billing and policy controls remaining intact. A genuinely offline copy survives a full account compromise. ### How often to test restores At minimum quarterly for critical systems and annually for the full estate. Scheduled access windows make recurring test restores straightforward to evidence. NCSC ransomware-resistant backups: https://fire-vault.com/compliance/ncsc-ransomware-resistant-backups Layer 1 vs logical air gap: https://fire-vault.com/learn/physical-vs-logical-air-gap All compliance frameworks: https://fire-vault.com/compliance Image: Mark Fermor (https://fire-vault.com/assets/mark-fermor-DWFWqeWL.jpg) Image: David Bailey (https://fire-vault.com/assets/david-bailey-Dgqj8eaE.jpg) Image: Kenny Phipps (https://fire-vault.com/assets/kenny-phipps-Dy-CtCjw.jpg) Online Now Get started ## Tell us which framework you are being tested against. We will map Offline Secure Storage® to the outcomes your assessor is checking, and give you the wording and evidence to submit. From £360 a month including VAT. 36-month commitment. First payment at checkout. From £360/mo VAT included 36-month plan ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/compliance/cyber-insurance-3-2-1-0#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Compliance", "item": "https://fire-vault.com/compliance" }, { "@type": "ListItem", "position": 3, "name": "Cyber Insurance and the 3-2-1-1-0 Rule", "item": "https://fire-vault.com/compliance/cyber-insurance-3-2-1-0" } ] }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/compliance/cyber-insurance-3-2-1-0#webpage", "url": "https://fire-vault.com/compliance/cyber-insurance-3-2-1-0", "name": "Cyber Insurance and the 3-2-1-1-0 Rule", "description": "Meet cyber insurer expectations by adding a physically disconnected Firevault as the '0' in a 3-2-1-1-0 backup posture.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-platform.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/compliance/cyber-insurance-3-2-1-0#breadcrumb" } } ] ```