--- title: "Cyber Insurance and the 3-2-1-1-0 Rule | Firevault" description: "Meet cyber insurer expectations by adding a physically disconnected Firevault as the '0' in a 3-2-1-1-0 backup posture." lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/compliance/cyber-insurance-3-2-1-0#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Compliance", "item": "https://fire-vault.com/compliance" }, { "@type": "ListItem", "position": 3, "name": "Cyber Insurance and the 3-2-1-1-0 Rule", "item": "https://fire-vault.com/compliance/cyber-insurance-3-2-1-0" } ] }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/compliance/cyber-insurance-3-2-1-0#webpage", "url": "https://fire-vault.com/compliance/cyber-insurance-3-2-1-0", "name": "Cyber Insurance and the 3-2-1-1-0 Rule", "description": "Meet cyber insurer expectations by adding a physically disconnected Firevault as the '0' in a 3-2-1-1-0 backup posture.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-platform.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/compliance/cyber-insurance-3-2-1-0#breadcrumb" } } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Co-operative Group 6.5M records ](/learn/breaches)[2026 Harrods Attempted intrusion ](/learn/breaches)[2026 Legal Aid Agency (Ministry of Justice) 2.1M records ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Co-operative Group 6.5M records ](/learn/breaches)[2026 Harrods Attempted intrusion ](/learn/breaches)[2026 Legal Aid Agency (Ministry of Justice) 2.1M records ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Overview The requirementThe gapsConsequencesThe architectureWhat sits offline Compliance, Cyber Insurance # 3-2-1-0 Backup, The Insurer Standard Cyber insurers now expect a real offline copy. Firevault Bunkers deliver the 0 in 3-2-1-0 with the audit trail underwriters want to see. - Offline by default - Identity locked access - Hardware encrypted Book a mapping call[Framework matrix](/compliance/frameworks) ![Security analyst reviewing an isolated workstation with disconnected cables](/assets/hero-square-analyst-DI5B7V_E.jpg) 3 Copies: production plus two protective copies 2 Different media, to avoid correlated failure 1 Offsite copy, physically separated from production 0 Errors on restore, and zero online copies 01 The requirement ## What 3-2-1-0 Actually Means A plain English breakdown of the rule insurers, regulators and boards keep referencing. Wording from underwriters such as Lloyd's syndicates, Beazley and AXA now references offline, immutable or air gapped backup as a control. This is a mapping , not a certification claim. Firevault holds Cyber Essentials Plus. Everything else on this page is stated as alignment: Offline Secure Storage® produces evidence you can point at in your own submission, assessment or audit. 02 What is tested ## The Rule, Line by Line Each line below is something an assessor, regulator or underwriter can ask you to evidence. Three copies: one copy alone is not resilience, it is hope Two media: a single firmware bug should not take both backups One offsite copy with documented chain of custody Zero verified errors, evidenced by regular test restores Zero copies reachable from production at the time of an attack 03 Consequences ## Where Strategies Fall Short What happens when the control is missing, and the record cannot be produced. ### Same Media Twice Both backups on one storage technology means one vendor incident can take both. ### Cold Cloud Is Still Online Glacier and similar tiers stay addressable through the cloud control plane and IAM. ### Untested Restores Insurers increasingly ask for documented test dates, scope and outcome. ### Egress and Handling Cost Per gigabyte retrieval fees and tape handling overhead both bite at the worst moment. 04 The architecture ## Tape, Cold Cloud, or Bunker The three credible ways to satisfy the offline copy requirement, and where each one wins or loses. ### Iron Mountain Tape A genuine physical air gap. The tradeoff is operational: recoveries can take days, handling errors are common and verifying restores at scale is painful. ### AWS Glacier and Cold Cloud Still reachable through the public cloud control plane. Retrieval is slower and cheaper than hot storage, but the data remains addressable and IAM dependent. ### Firevault Bunkers A tape style physical air gap with scheduled, identity verified online windows for restores. CNI-grade bunkers and no per gigabyte egress to budget around. ### Layer 1 Disconnection Between sessions the drives have no network connection, so the offline copy survives a complete production or cloud account compromise. ### Underwriter Evidence Pack A control attestation pack covering Layer 1 disconnection, identity verified access, audit trails and bunker physical security, written to hand to brokers. ### Documented Custody Geographic separation with a recorded chain of custody and verified retrieval for every session. “The 0 in 3-2-1-0 is the only part of the rule an attacker cannot argue with. A copy with no network connection is not a policy, it is a fact.” Mark Fermor, Founder, Firevault 05 What sits offline ## What the Offline Copy Holds The records most often moved into Offline Secure Storage® for this framework. Gold copies of production systems Backup catalogues and recovery keys Regulated records under retention duties Finance and payroll archives Restore test evidence for underwriters Board and audit reporting packs ### Do insurers really require an offline copy? An increasing share do, particularly in mid market and enterprise lines. Premiums and coverage scope are routinely linked to evidence of these controls. ### Where the 0 comes from The 0 has two readings and Firevault recommends covering both: zero errors during restore testing, and zero copies reachable from the production network during an attack. ### Is cloud immutability enough? It is a strong layer, not a complete one. Cloud immutability still depends on identity, billing and policy controls remaining intact. A genuinely offline copy survives a full account compromise. ### How often to test restores At minimum quarterly for critical systems and annually for the full estate. Scheduled access windows make recurring test restores straightforward to evidence. [NCSC ransomware-resistant backups](/compliance/ncsc-ransomware-resistant-backups) [Layer 1 vs logical air gap](/learn/physical-vs-logical-air-gap) [All compliance frameworks](/compliance) ### Authoritative Sources - [ICO GDPR Guidance (ICO) ](https://ico.org.uk/for-organisations/guide-to-data-protection/) - [NCSC Offline Backups in an Online World (NCSC) ](https://www.ncsc.gov.uk/guidance/offline-backups-in-an-online-world) ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ![David Bailey](/assets/david-bailey-Dgqj8eaE.jpg) ![Kenny Phipps](/assets/kenny-phipps-CVyooRsR.jpg) Online Now Concierge ## Tell us which framework you are being tested against. We will map Offline Secure Storage® to the outcomes your assessor is checking, and give you the wording and evidence to submit. Takes about 2 minutes. No account needed. Find Out Free 2 mins No sign-up