--- title: "What Operational Technology Data Should Be Kept… | Firevault" description: "Which operational technology files create the greatest consequence when compromised, why connected backups still leave them exposed, and how offline custody…" lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/offline-secure-storage-operational-technology#webpage", "url": "https://fire-vault.com/news/offline-secure-storage-operational-technology", "name": "What Operational Technology Data Should Be Kept…", "description": "Which operational technology files create the greatest consequence when compromised, why connected backups still leave them exposed, and how offline custody…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/16066e63-cd2f-44dd-bc5d-57388f3f260c/offline-ot-storage-featured-2x.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/offline-secure-storage-operational-technology#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/offline-secure-storage-operational-technology#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "What Operational Technology Data Should Be Kept Offline?", "item": "https://fire-vault.com/news/offline-secure-storage-operational-technology" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "What Operational Technology Data Should Be Kept Offline?", "description": "Which operational technology files create the greatest consequence when compromised, why connected backups still leave them exposed, and how offline custody supports safe recovery.", "url": "https://fire-vault.com/news/offline-secure-storage-operational-technology", "image": [ { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/16066e63-cd2f-44dd-bc5d-57388f3f260c/offline-ot-storage-featured-2x.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/16066e63-cd2f-44dd-bc5d-57388f3f260c/offline-ot-storage-featured-2x.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/16066e63-cd2f-44dd-bc5d-57388f3f260c/offline-ot-storage-featured-2x.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://fire-vault.com/__l5e/assets-v1/16066e63-cd2f-44dd-bc5d-57388f3f260c/offline-ot-storage-featured-2x.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Director & Co-Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-04-23T00:00:00+00:00", "dateModified": "2026-08-28T08:03:22.256672+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/offline-secure-storage-operational-technology" }, "inLanguage": "en-GB", "articleSection": "Insight", "wordCount": 1451, "keywords": "What, Insight, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "A production stoppage rarely begins with a dramatic breach alert. More often, it starts with a single exposed file, an inherited remote connection, or an engineering record stored in the wrong place. In operational environments, the damage is not limited to data loss. It can affect uptime, safety, supplier commitments, regulatory duties, and board-level accountability. That is why offline secure s", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Overview Why offline secure storage for o…What should be kept offlineWhere organisations get OT stora…How offline secure storage suppo…Choosing an offline secure stora…The board-level question behind …More Resources [Knowledge Vault](/learn/knowledge)/ [Insight](/learn/knowledge?filter=insight) Insight · 23 April 2026 # What Operational Technology Data Should Be Kept Offline? Which operational technology files create the greatest consequence when compromised, why connected backups still leave them exposed, and how offline custody supports safe recovery. ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) Mark Fermor Director & Co-Founder, Firevault 8 min read Share [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Foffline-secure-storage-operational-technology)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Foffline-secure-storage-operational-technology&text=What%20Operational%20Technology%20Data%20Should%20Be%20Kept%20Offline%3F%0A%0AWhich%20operational%20technology%20files%20create%20the%20greatest%20consequence%20when%20compromised%2C%20why%20connected%20backups%20still%20leave%20them%20exposed%2C%20and%20how%20offline%20custody%20supports%20safe%20recovery.)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Foffline-secure-storage-operational-technology)[](mailto:?subject=What%20Operational%20Technology%20Data%20Should%20Be%20Kept%20Offline%3F&body=Which%20operational%20technology%20files%20create%20the%20greatest%20consequence%20when%20compromised%2C%20why%20connected%20backups%20still%20leave%20them%20exposed%2C%20and%20how%20offline%20custody%20supports%20safe%20recovery.%0A%0Ahttps%3A%2F%2Ffire-vault.com%2Fnews%2Foffline-secure-storage-operational-technology) ![Steel padlock on stacked server drives in a dark industrial data centre](/__l5e/assets-v1/16066e63-cd2f-44dd-bc5d-57388f3f260c/offline-ot-storage-featured-2x.jpg) Steel padlock on stacked server drives in a dark industrial data centre Why it matters ## What this means for organisations holding critical data Which operational technology files create the greatest consequence when compromised, why connected backups still leave them exposed, and how offline custody supports safe recovery. In this analysis 1. 01 [Why offline secure storage for o…](#section-0) 2. 02 [What should be kept offline](#section-1) 3. 03 [Where organisations get OT stora…](#section-2) 4. 04 [How offline secure storage suppo…](#section-3) 5. 05 [Choosing an offline secure stora…](#section-4) **On this page**[Why offline secure storage for o…](#section-0)[What should be kept offline](#section-1)[Where organisations get OT stora…](#section-2)[How offline secure storage suppo…](#section-3)[Choosing an offline secure stora…](#section-4) A production stoppage rarely begins with a dramatic breach alert. More often, it starts with a single exposed file, an inherited remote connection, or an engineering record stored in the wrong place. In operational environments, the damage is not limited to data loss. It can affect uptime, safety, supplier commitments, regulatory duties, and board-level accountability. That is why [offline secure storage](/offline-secure-storage) for operational technology deserves closer attention. Operational technology carries a different kind of consequence from conventional business IT. It includes control system documentation, configuration files, maintenance records, network diagrams, recovery procedures, firmware packages, access credentials, and other information that can directly affect how critical systems are run and restored. If that material is altered, stolen, or simply unavailable when needed, the impact moves quickly from cyber risk to operational disruption. ## Why offline secure storage for operational technology matters Many OT environments still depend on records and digital assets that were never designed for permanent online exposure. Yet over time, convenience tends to win. Files are copied into shared drives, emailed between teams, or kept in connected repositories because they are easier to reach. That convenience creates a path. Once sensitive OT data is reachable through a network, it becomes part of the attack surface. The issue is not only malicious access. Exposure also increases the chance of internal error, uncontrolled duplication, and confusion over which version is authoritative. In OT, uncertainty is a serious weakness. An outdated system image, the wrong network map, or an unauthorised change log can delay response during an incident or maintenance window. Offline Secure Storage changes the question. Instead of asking how to defend sensitive operational data while it remains exposed, it asks whether that data needs to be connected at all when it is not actively being used. If it does not, then disconnecting it removes the route that most attacks, fraud attempts, and unauthorised access rely on. ## What should be kept offline Not every operational file needs the same level of protection. Some material supports day-to-day work and may need controlled online availability. Other material is too sensitive, too consequential, or too rarely accessed to justify continuous exposure. In practice, the strongest candidates for offline storage are the items that would cause disproportionate harm if lost, altered, or exposed. That often includes controller backups, engineering workstation images, site recovery packs, sensitive schematics, privileged credentials, vendor access records, and incident response documentation. It can also include commercially sensitive operational data such as plant layouts, process instructions, or acquisition-related technical files. The deciding factor is not simply confidentiality. It is consequence. If a file would matter during a shutdown, a dispute, an investigation, or a recovery event, it should be assessed for offline protection. ### The difference between backup and offline protection This is where organisations often make a costly assumption. They may believe that because OT data is copied somewhere, it is sufficiently protected. Backup has its place, but backup and offline protection are not the same thing. A copy that remains connected, routinely accessible, or broadly reachable through existing systems still carries exposure. It may help with recovery from accidental deletion or some forms of failure, but it does not necessarily remove the path for compromise. Offline secure storage is about deliberate disconnection. The data is physically out of reach when not in authorised use. That difference matters most when [facing ransomware](https://fire-vault.com/threats/ransomware), credential misuse, insider risk, or a wider breach affecting connected infrastructure. If sensitive operational data is not connected, it cannot be reached through the same routes. ## Where organisations get OT storage wrong The weakness is rarely a complete absence of security controls. More often, it is the slow accumulation of exceptions. Engineers need quick access, third parties need temporary visibility, and teams duplicate files to avoid delay. Over time, critical information ends up in too many places, under too many permissions, with too little certainty over who can access what. Another common mistake is treating OT data as if it were ordinary corporate content. It is not. A leaked sales document is a problem. A compromised configuration file or recovery package can affect physical operations. The governance model has to reflect that difference. There is also a tendency to focus security investment on perimeter protection and monitoring while leaving high-value data continuously available behind those controls. That approach assumes the barriers will hold. Sometimes they do. Sometimes they do not. For the most sensitive operational assets, reducing exposure is stronger than relying on detection alone. ## How offline secure storage supports operational resilience Operational resilience is often discussed in terms of uptime, redundancy, and recovery procedures. Those elements matter, but they depend on trusted information being available when needed. If the data required to restore systems or verify integrity has been tampered with, encrypted, or exposed, resilience becomes harder to achieve. Offline secure storage strengthens resilience by preserving a controlled source of truth outside the reach of day-to-day network threats. It gives organisations a way to hold critical operational data in a state that is inaccessible by default and only available during authorised sessions. That is a materially different security posture from keeping everything online and hoping access controls are enough. For regulated sectors and critical operations, this also supports stronger governance. Leadership teams are increasingly expected to show not just that controls exist, but that they are proportionate to consequence. Keeping high-impact operational data offline demonstrates clear intent: reduce the chance of compromise before it happens. ### It is not for everything, and that is the point There is a trade-off. Offline storage is not designed for constant editing, broad collaboration, or convenience-led workflows. That is precisely why it works for high-value material. The discipline of [controlled access](/news/controlled-access-buyers-guide-offline-secure-storage) creates friction, but useful friction. It forces organisations to distinguish between what must be available all the time and what should only be accessed with authorisation and purpose. For many OT environments, that separation is overdue. The most critical files are often the least suitable for permanent connectivity. If a document, system image, or credential set underpins recovery, safety, or operational continuity, convenience should not be the deciding factor. ## Choosing an offline secure storage approach for OT The right approach depends on the role the data plays, who needs access, and how often it is used. Some organisations need to protect a narrow set of highly sensitive records. Others need a formal repository for operationally critical material across multiple sites or teams. What matters is architecture. An effective model is offline by default, built around controlled access, and designed to reduce reliance on assumptions about network safety. Identity verification, session-based access, and dedicated hardware all matter because they support accountability. So does clarity around ownership. Someone should know what is stored, why it is there, who can reach it, and under what authority. This is not an IT housekeeping exercise. It is a control decision. The strongest implementations are led by the reality of consequence, not by a wish to tidy up storage estates. In environments where outage, safety risk, or regulatory scrutiny are genuine concerns, offline secure storage should sit alongside wider cyber and operational controls, not behind them as an afterthought. Firevault reflects this principle clearly: protection is strengthened when sensitive data is [physically disconnected](https://fire-vault.com/offline-secure-storage/physical-control) and inaccessible unless deliberately authorised. ## The [board-level question](https://fire-vault.com/learn/guides/board-guide-cyber-governance) behind the technology For directors and operational leaders, the real issue is simple. Which information would create serious harm if it were exposed, altered, or unavailable tomorrow? Once that question is answered honestly, a second follows quickly: why is any of it continuously connected today? That is the value of offline secure storage for operational technology. It replaces vague confidence with a more defensible position. Sensitive operational data is kept out of reach until there is a legitimate reason to access it. Exposure is reduced by design, not merely managed by layers of software and policy. For organisations responsible for critical systems, sensitive processes, or high-consequence environments, that shift is hard to ignore. If the data matters enough to affect operations, safety, recovery, or trust, it deserves a storage model built on control rather than convenience. The clearest protection is often the simplest one: if critical operational data does not need to be connected, keep it offline until it does. **How Firevault helps** - **[Offline Secure Storage](/offline-secure-storage)** keeps gold-copy data physically disconnected from the network, so a ransomware or exfiltration event cannot reach it. - **[Control](/control)** gives boards and operators a single view of what is online, what is isolated, and what is recoverable across the estate. - **[Firebreak](/firebreak)** delivers hardware-enforced disconnection at Layer 1, so exposed credentials or compromised network paths cannot become a route into the vault. _Talk to Firevault about [Disconnect to Protect®](/about) for your organisation._ About the author ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ### Mark Fermor [](https://www.linkedin.com/in/mfermor) Director & Co-Founder Co-founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. [![Firevault Bunker, the protected physical location for Offline Secure Storage hardware](/__l5e/assets-v1/75208f4e-fc6f-46d8-80b9-606c43dfef28/firevault-bunker-building.webp)](/why-oss) The Firevault view**Offline Secure Storage® keeps a clean copy beyond the reach of an attacker.**[Why #OSS →](/why-oss) [![The nine Control modules arranged around the Firevault platform](/__l5e/assets-v1/829a8768-a871-41d0-8a79-3645ca7f5e83/platform-wheel.jpg)](/solutions/control) Control systems and access**Cut the physical paths attackers and third parties depend on.**[Explore Control →](/solutions/control) [![Firevault 2TB Vault hardware](/__l5e/assets-v1/ed09bfc1-2f0f-491d-b1aa-861542a5fb33/hero-vault-2tb.png)](/get-started) Get started**Get started, or talk to a member of the team.**[Get started →](/get-started) How Firevault would handle this ## A recovery copy an attacker cannot reach Offline Secure Storage® keeps a clean copy of your data on hardware that is physically disconnected, so backup and recovery do not depend on systems an intruder can touch. [Get started](/get-started)[Talk to the team](/demo) **Hardware**Your copy sits on dedicated encrypted hardware **Disconnect**Offline by default, connected only when you say so **Recovery**A known-clean copy to rebuild from, on your timetable **Location**Held in a secure Firevault Bunker Related Reading ## You may also find these useful [ ![Airport WiFi sign-ups turn into a national data problem as 8.7 million customer records are accessed](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/manchester-airports-group-data-breach-2026.jpg) Insight ### Airport WiFi sign-ups turn into a national data problem as 8.7 million customer records are accessed Manchester Airports Group has confirmed that criminal hackers accessed the data of about 8.7 million customers across Manchester, East Midlands and London Stansted. New research shows no hacking was required: server-side marketing API keys sat in the public JavaScript of all three airport websites, unrotated, for more than four years. 27 Aug 2026 8 min ](/news/manchester-airports-group-data-breach-87-million-customers-2026)[ ![T-Mobile pulled the plug on Salt Typhoon. It took a car journey to get there.](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/tmobile-power-pull-salt-typhoon-2026.jpg) Insight ### T-Mobile pulled the plug on Salt Typhoon. It took a car journey to get there. T-Mobile's security chief ended months of failed software remediation by driving to the data centre, clearing ID, finding the cabinet and physically pulling the power supply from the compromised hardware. Disconnection was the right control. Firevault Control is designed to take the same action in under six milliseconds. 27 Aug 2026 7 min ](/news/tmobile-severs-network-cable-salt-typhoon-hackers-2026)[ ![Beacon breach: 1,500 charities exposed and an HIV charity's health data stolen](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/george-house-trust-beacon-charity-data-breach-2026.jpg) Insight ### Beacon breach: 1,500 charities exposed and an HIV charity's health data stolen People supported by a Manchester HIV charity have been told sensitive health information may have been stolen after a breach at Beacon, the shared database platform used by more than a thousand UK charities. One supplier, one connected database, national exposure. 26 Aug 2026 3 min ](/news/beacon-charity-database-breach-hiv-charity-health-data-2026)[ ![Iran-linked hackers shut down a UK power plant for four days](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/iran-uk-power-plant-cyber-attack-2026.jpg) Insight ### Iran-linked hackers shut down a UK power plant for four days A small British generator was taken offline for four days after an Iran-linked cyber attack, reported as the first successful intrusion of its kind against UK power generation. The grid held. The control layer did not. 23 Aug 2026 4 min ](/news/iran-linked-hackers-uk-power-plant-shutdown-2026)[ ![GTA 6 leaks: a nightmare or a blip for the biggest video game of the year?](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/gta6-leaks-rockstar-2026.jpg) Insight ### GTA 6 leaks: a nightmare or a blip for the biggest video game of the year? Unreleased Grand Theft Auto 6 footage has appeared online ahead of Rockstar's official preview, and Take-Two is now in court seeking the identities behind the accounts sharing it. The game will still sell. The material that leaked can never be unseen. 22 Aug 2026 3 min ](/news/gta-6-leaks-rockstar-development-footage-2026)[ ![Nine PBS: 50 Terabytes of History Trapped by a Cloud Vendor That Closed](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/nine-pbs-archives-cloud-vendor-shutdown-2026.jpg) Insight ### Nine PBS: 50 Terabytes of History Trapped by a Cloud Vendor That Closed A public broadcaster lost access to fifty terabytes of archival footage, spanning seventy years of regional history, when its cloud storage supplier suddenly went out of business. The files are still trapped in a Denver data centre. 18 Aug 2026 4 min ](/news/nine-pbs-archives-cloud-vendor-shutdown-2026) ## Suggested Reading - [What is Offline Secure Storage The foundation of physical disconnection ](/how-it-works/offline-secure-storage) - [Why Offline Secure Storage The case for physical control ](/why-oss) - [Ransomware Defence Hold gold copies offline ](/oss-for-ransomware-recovery) - [Control Physical path control for IT and OT ](/solutions/control) - [Knowledge Vault All articles, guides and whitepapers ](/learn/knowledge) - [Book a Demo See Firevault in action ](/demo) [Back to Knowledge Vault](/learn/knowledge)