NCSC cloud backup compliance guide.
Physical disconnection, mapped.

Alignment is a case to evidence, not a badge.

The NCSC cloud backup compliance guide below maps Offline Secure Storage® to the five principles in NCSC’s ransomware-resistant cloud backup guidance. It is Firevault commentary, not an NCSC assessment, endorsement or certification of Firevault.

Using OSS means selected data has a copy that is physically disconnected by default, with hardware-enforced isolation from the connected environment while disconnected. Authorised access temporarily reconnects the selected data path. The physical connection is broken again when the session ends.

The cloud principles assess the complete backup service. Physical disconnection supports one protective boundary. It does not automatically establish retention, independent recovery access, recoverable keys, alerts or a successful restore.

NCSC’s collection addresses destructive ransomware. Applying these principles does not by itself address data theft and extortion. Protect connected data, identities and applications as well as retained copies.

Where NCSC explicitly names physical disconnection.

NCSC’s separate on-premises backup principles include “Make it possible to isolate your backup solution”. Under that principle, NCSC states:

“Storing physically disconnected backup media separately, off the network, makes it more difficult for an attacker to access backups.”

This is a direct reference to physically disconnected media in the on-premises guidance, not an additional cloud principle or a requirement that every cloud service use Firevault’s approach. Assess the applicable guidance against who manages the storage and the responsibilities of the complete service.

Offline and immutable are different properties. Physical disconnection restricts network reachability while disconnected. Immutability governs whether retained data can be altered or deleted. Neither label alone proves recoverability.

The five cloud principles, mapped.

Quoted principle wording is NCSC’s. Each contribution, limitation and evidence request beneath it is Firevault’s assessment commentary. No deployment conformity is established by this guide.

Resilience to destructive actions

“Backups should be resilient to destructive actions” NCSC

Physical-disconnection contribution

Offline Secure Storage holds selected data on storage that is physically disconnected by default. Hardware-enforced isolation removes the selected connected data path while disconnected, reducing exposure to network-based deletion or alteration through that path.

What remains unproven

Physical disconnection is not immutability. It does not establish protection during authorised access, against physical interference or against corrupted data being written into the copy.

Evidence to request

Record verified disconnection, access-window controls, physical custody, retention and overwrite rules. Test whether privileged destructive actions can affect retained copies when access is authorised.

Recovery access that survives compromise

“A backup system should be configured so that it isn’t possible to deny all customer access” NCSC

Physical-disconnection contribution

A retained offline copy and separate, non-IP connection-control process can contribute to a recovery route distinct from routine production access. Connection authorisation and the ability to read or restore data are separate requirements.

What remains unproven

Disconnection does not guarantee access. Lost identities, devices, keys, service dependencies or provider access arrangements can still prevent recovery.

Evidence to request

Test recovery with production accounts and devices unavailable. Document independent authorisation, emergency access, key availability, contractual access arrangements and accountable recovery owners.

An earlier usable recovery point

“The service allows a customer to restore from a backup version, even if later versions become corrupted” NCSC

Physical-disconnection contribution

Physically disconnected copies can help preserve an earlier recovery point when retained independently of later writes. The backup process must actually keep those versions.

What remains unproven

One offline copy is not a version history. Rotation, overwrite or replication of corruption can still remove the last usable state.

Evidence to request

Agree a time-based retention period and test restoration from an older version after a newer version is corrupted. NCSC suggests time-based retention rather than only a fixed number of backups, to resist flooding with corrupted versions.

Protected and recoverable encryption keys

“Robust key management for data-at-rest protection is in use” NCSC

Physical-disconnection contribution

Offline storage can hold an independently protected recovery-key copy where an approved key-management policy permits it. Keeping data offline and managing encryption keys remain distinct controls.

What remains unproven

A physically disconnected encrypted backup is unusable if its keys are lost. Disconnection alone proves neither encryption strength nor secure key custody.

Evidence to request

Document encryption, key ownership, custody, access, rotation and independent recovery. Demonstrate restoration when the production key infrastructure is unavailable, without exposing keys in the assessment record.

Alerts that reach an accountable responder

“Alerts are triggered if significant changes are made, or privileged actions are attempted” NCSC

Physical-disconnection contribution

Physical disconnection is a preventive boundary. Monitoring, alert delivery and incident response must be supplied and verified separately across the backup service and its administration.

What remains unproven

An offline copy is not an alerting system. A connection log alone does not prove alerts for failed privileged attempts, retention changes, mass deletion or backups stopping.

Evidence to request

Test alerts for successful and unsuccessful significant attempts. Include administrative, retention and encryption changes, deletion and stopped backups. Verify delivery when production infrastructure is compromised and record the response procedure.

A defensible UK public-sector evidence pack.

For G-Cloud and other UK public-sector bids, describe the actual service and its boundaries. The following is suggested service wording, not proof that a listing has been approved or that a procurement requirement has been met:

“Selected data is held on storage that is physically disconnected by default, providing hardware-enforced isolation from the connected environment while disconnected. Authorised sessions permit controlled access, after which the physical connection is broken again. Alignment with applicable NCSC backup principles is assessed across the complete service and its operating procedures.”

• Scope and responsibility: identify the data, systems, service owners, supplier obligations, physical custody and relevant cloud or on-premises guidance.
• Isolation and access: retain verification of disconnected states and authorised access. Record alternate routes and what remains exposed during access, without disclosing implementation secrets.
• Retention and restoration: agree time-based recovery history and demonstrate restoration from an older clean version. Record measured recovery point and recovery time results against the agreed objectives, not an assumed guarantee.
• Independent recovery: test access and key recovery when production identities, devices or key infrastructure are unavailable.
• Monitoring and response: test alerts outside compromised production infrastructure and document who acts, how quickly and with what escalation.
• Operational assurance: record regular backup-health checks and restore exercises, physical and environmental protection, exceptions, test dates and corrective actions.

NCSC describes suggested implementations, not one mandated product design. Soft-delete recovery periods, delayed destructive actions and alerts still require monitoring and an effective response. A disconnected copy does not supply those operating procedures automatically.

Source record.

NCSC primary sources reviewed on 31 October 2026. The referenced collection and principle pages identify publication and review on 22 November 2024, version 1.0. Check the current guidance when preparing an assessment.

1. NCSC: Principles for ransomware-resistant cloud backups

   The five cloud principles and their suggested implementations. These assess the complete service, not simply the storage medium.

2. NCSC: Principles for ransomware-resistant on-premises backups

   The separate on-premises principles explicitly discuss physically disconnected media under isolation.

3. NCSC: Ransomware-resistant backups

   Scope, destructive-ransomware threat model and the responsibility to test and monitor backup health.

For the storage and access context, see How OSS works. This guide adds an evidence-led compliance mapping alongside the existing NCSC backup whitepaper.

Bring the requirement. Examine the evidence.

Discuss your backup scope, procurement requirements and recovery tests. Establish what physical disconnection contributes and what the full service must still demonstrate.

Discuss your evidence requirements