NCSC Ransomware-Resistant Backup Principles
How Firevault maps to the National Cyber Security Centre principles for backups that survive a destructive attack. Principle by principle, with the architectural answer for each.
- Offline by default
- Identity locked access
- Hardware encrypted
5
NCSC principles for ransomware-resistant backups
Layer 1
Where Offline Secure Storage disconnects, below the network
0
Network interfaces on the gold copy while offline
Backups Are the Target
NCSC publishes its principles freely at ncsc.gov.uk. They describe what an offline copy must do to survive an attacker who has already reached the production estate. NCSC does not certify products, so the framing here is alignment, not certification.
This is a mapping, not a certification claim. Firevault holds Cyber Essentials Plus. Everything else on this page is stated as alignment: Offline Secure Storage® produces evidence you can point at in your own submission, assessment or audit.
- 5 — NCSC principles for ransomware-resistant backups. Source: NCSC, Principles for ransomware-resistant cloud backups
The Five NCSC Principles
Each line below is something an assessor, regulator or underwriter can ask you to evidence.
Backups should be resilient to destructive actions
A backup system should be configured so that it is not possible to deny customers access to their data
The system should allow you to restore from a backup of last resort
The actions required to access backups should be sufficiently distinct from day to day actions
Backups should be regularly tested
Where Online Backup Falls Short
What happens when the control is missing, and the record cannot be produced.
Destructive Actions Reach Backups
An attacker inside production can reach any target that still has a network interface.
Access Can Be Denied
Cloud backup consoles can be locked out, billing-suspended or abused through the identity layer.
No Distinct Access Path
If restoring uses the same credentials as day to day work, an intruder inherits the path.
Object Lock Is Not Offline
Immutable buckets remain reachable over the provider API and depend on software policy.
Five NCSC Principles, Five Firevault Answers
Offline Secure Storage is purpose-built around the same threat model NCSC describes: physical disconnection, a separate management plane and audited restore.
Resilient to Destructive Actions
The gold copy sits on hardware physically disconnected at Layer 1. A destructive action cannot reach a target with no network interface or IP address.
Access Cannot Be Denied
A separate management plane and customer-held identity factors mean no single account compromise can deny access to the data.
Backup of Last Resort
The gold copy sits offline in carefully selected colocation bunkers, brought online only inside an identity-verified connection window.
Distinct From Day to Day
Access needs a scheduled physical connection, a separate identity and out-of-band approval, not production credentials.
Regularly Tested
Recurring verification windows bring the copy online, checksum-verify it and restore in part, with every test event logged.
Tamper-Evident Evidence
Every connection, disconnection, identity verification and restore is recorded for regulators, insurers and board reporting.
“A destructive action on production cannot reach a target that has no network interface. That is the whole argument, and it is a physical one.”
Mark Fermor, Founder, Firevault
What the Gold Copy Holds
The records most often moved into Offline Secure Storage® for this framework.
Immutable gold copies of critical systems
Backup catalogues and recovery keys
Regulated records with retention duties
Configuration and infrastructure state
Restore verification evidence
Audit trails for insurers and regulators
Layer 1, not Layer 2
Hardened repositories and immutable buckets sit on the network and depend on software policy. Offline Secure Storage sits below the network at the physical layer, so the control cannot be bypassed in software because there is no software path while offline.
Evidence packs, not assertions
Principles only matter if you can prove them. Firevault produces per-event logs with identity captured, packaged as evidence regulators, insurers and boards now ask for.
Alignment, not certification
NCSC does not certify products. Firevault maps its architecture to each published principle and hands over the evidence so you can make the case yourself.
Alongside 3-2-1-1-0
3-2-1-1-0 is the operational rule of thumb. The NCSC principles describe the properties that offline copy needs to actually resist a destructive attack. Firevault is designed to satisfy both.
Tell us which framework you are being tested against.
We will map Offline Secure Storage® to the outcomes your assessor is checking, and give you the wording and evidence to submit.
Takes about 2 minutes. No account needed.