Compliance · NCSC on-premises backups

NCSC on-premises backup principles, mapped.

How Firevault maps to the NCSC principles for ransomware-resistant on-premises backups, principle by principle.

6 NCSC principles
Layer 1 disconnection
No network interface while offline

Offline by default
Identity-locked access
Encrypted
Session logs

As featured in

The requirement

Attackers go for the on-premises copy first.

NCSC observes that attackers often go after backups early in a destructive attack. Its principles set out what a backup solution must do before it can be considered resistant to destruction.

What it asks

A backup solution should resist destruction by an attacker with production rights, so recovery does not depend on what the attacker left behind.

Alignment, not certification

This is a mapping, not a certification claim. Confirm current Cyber Essentials Plus status, scope and validity with Firevault. Everything else on this page is alignment, with evidence you can use in your own assessment.

Physically disconnected Offline Secure Storage: server, three drives and a padlock

What is tested

The six NCSC on-premises principles.

Each line is something an assessor, regulator or underwriter can ask you to evidence.

1
Make it possible to isolate your backup solution

Isolation that an attacker in production cannot undo.
2
Update your backup solution

Unpatched backup software is an entry point.
3
Backups should be resilient to destructive actions

A copy that survives an attacker with production rights.
4
Restore from an earlier backup

Restoration is possible even if later versions are corrupted.
5
Robust key management

Keys for data at rest are protected and held apart.
6
Alerts on significant changes

Alerts fire when privileged actions are attempted.

Where it falls short

Where a typical on-premises estate falls short.

The gaps the principles are written to close.

The backup server stays on the network

An always-reachable appliance is always a target. Segregation lowers the odds without removing the path.

Shared identity and shared keys

If backup admin shares a directory with production, one privileged compromise exposes both data and keys.

Only the latest copy survives

Short retention or replicated corruption removes the clean earlier states that recovery from long dwell-time attacks depends on.

Immutability is still software policy

Hardened repositories and object lock can still be reached over an API.

The architecture

Six principles, six Firevault answers.

Built around the same threat model: physical disconnection, a separate management plane, encryption and audited restore.

Isolation that is physical

The offline gold copy has no network interface or address. Connection is a scheduled, identity-verified event.

Maintained by Firevault

Updates happen in controlled windows, and the attack surface stays small while offline.

Resilient to destructive actions

Production, domain and hypervisor credentials grant no rights on the offline copy.

Earlier clean states retained

Multiple point-in-time copies stay offline, and restores are checksum-verified.

Keys held away from the data

Encryption uses customer-held identity factors, managed separately from the protected systems.

Out-of-band alerting and logs

Connections, identity checks, privileged actions and restores are logged, alerted and packaged as evidence.

An on-premises backup that still answers on the network is still in scope for the attack.

What sits offline

What the on-premises gold copy holds.

The records most often moved into Offline Secure Storage® for this framework.

Gold copies of critical systems
Backup catalogues and recovery keys
Regulated records with UK retention duties
Configuration and infrastructure state
Restore verification evidence
Audit trails for insurers and regulators

Layer 1, not Layer 2Network-based repositories depend on software policy. Offline Secure Storage® sits physically below the network.
Evidence packs, not assertionsPer-event logs, with the identity captured.
Alignment, not certificationFirevault maps its architecture to the principles and supplies evidence for your own case.
On-premises and cloud are separateFor the cloud principles, see the ransomware-resistant backups page.

Authoritative sources

Read the guidance for yourself.

NCSC

Principles for ransomware-resistant on-premises backups

The six principles this page maps to.

Read the collection

NCSC

Offline backups in an online world

Why at least one backup should be offline and separate from the network it protects.

Read the NCSC blog

Tell us which framework you are being tested against.

We will map Offline Secure Storage® to the outcomes your assessor is checking, with wording and evidence you can submit. From £360 a month including VAT. 36-month commitment.

Book a mapping call Get started