--- title: "3-2-1-1-0 Backup Whitepaper: The Modern Backup | Firevault" description: "The 3-2-1-1-0 backup rule, why software immutability fails the zero, and how Firevault Bunkers satisfy NIS2, CAF 4.0, IEC 62443 and NCSC guidance." lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/learn/3-2-1-1-0-whitepaper#webpage", "url": "https://fire-vault.com/learn/3-2-1-1-0-whitepaper", "name": "3-2-1-1-0 Backup Whitepaper: The Modern Backup", "description": "The 3-2-1-1-0 backup rule, why software immutability fails the zero, and how Firevault Bunkers satisfy NIS2, CAF 4.0, IEC 62443 and NCSC guidance.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-learn.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/learn/3-2-1-1-0-whitepaper#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/learn/3-2-1-1-0-whitepaper#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "3-2-1-1-0 Backup Whitepaper: The Modern Backup", "item": "https://fire-vault.com/learn/3-2-1-1-0-whitepaper" } ] }, { "@context": "https://schema.org", "@type": "TechArticle", "headline": "How Firevault Meets 3-2-1-1-0 and CNI Standards", "description": "A technical whitepaper on physical disconnection, air-gapped storage, and compliance with NIS2, CAF 4.0, IEC 62443, and NCSC guidance.", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Co-Founder", "affiliation": { "@type": "Organization", "name": "Firevault" } }, "publisher": { "@type": "Organization", "name": "Firevault", "url": "https://fire-vault.com" }, "datePublished": "2026-04-22", "dateModified": "2026-04-22", "mainEntityOfPage": "https://fire-vault.com/learn/3-2-1-1-0-whitepaper", "about": [ "3-2-1-1-0 backup strategy", "air-gapped storage", "NIS2", "CAF 4.0", "IEC 62443", "offline secure storage" ] } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) [Home](/)[Learn](/learn)[Whitepapers](/learn/whitepapers)3-2-1-1-0 and CNI Standards Technical whitepaper # How Firevault Meets 3-2-1-1-0 and CNI Standards A technical whitepaper on physical disconnection, air-gapped storage, and compliance with NIS2, CAF 4.0, IEC 62443, and NCSC guidance. By Mark Fermor, Co-Founder, Firevault, April 2026. - NIS2 - CAF 4.0 - IEC 62443 - NCSC [Talk to the team](/contact?subject=enterprise) [Read the briefing](#executive-summary) ![Corridor of offline storage racks inside a Firevault bunker](/assets/hero-square-bunker-B6Y7Qt9r.jpg) 01 Executive summary ## The offline requirement that most vendors fail The 3-2-1-1-0 backup strategy is the current gold standard for data resilience. It requires three copies of data, on two different media types, with one copy offsite, one copy offline or air-gapped, and zero errors after verification. Most backup vendors claim to meet this standard through software-defined immutability, but their storage remains network-attached and reachable via management planes, APIs, and administrative interfaces. Firevault is the only commercial storage platform that fulfils the offline requirement through physical disconnection at OSI Layer 1. When not in use, Firevault storage has no electrical connection to any network. No standby power. No wireless interface. No management plane. This whitepaper explains how Firevault meets 3-2-1-1-0 requirements and aligns with Critical National Infrastructure (CNI) standards including NIS2, CAF 4.0, IEC 62443, and NCSC guidance. ## What 3-2-1-1-0 Means Element Requirement Purpose 3 Three copies of data Redundancy against single-point failure 2 Two different media types Protection against media-specific failure 1 (offsite) One copy stored offsite Geographic separation from primary site 1 (offline) One copy offline or air-gapped Isolation from network-based attacks 0 Zero errors after verification Confirmed recoverability The fourth element (1 offline) is where most organisations fail. Placing a backup in a separate cloud region or behind a firewall does not satisfy this requirement. The storage must be disconnected through any digital path. ## The Problem with Software-Defined Air Gaps Software-defined immutable storage solutions from vendors such as Veeam, Commvault, Cohesity, and Rubrik provide important protections against accidental deletion and basic ransomware. However, they share a fundamental architectural limitation: the storage remains network-attached. **Attack vectors that bypass software-defined immutability:** - **Management plane compromise:** administrative interfaces can be exploited to disable immutability settings, delete snapshots, or modify retention policies. - **Credential theft:** compromised admin credentials can override WORM policies through vendor support channels or emergency break-glass procedures. - **Zero-day exploits:** vulnerabilities in the storage platform software can bypass immutability controls before patches are available. - **Supply chain attacks:** compromised updates to the storage platform can introduce backdoors that circumvent immutability. - **Insider threat:** a privileged administrator with management plane access can modify or destroy data regardless of immutability flags. A physical air gap removes all of these vectors simultaneously. If there is no network connection, there is no management plane, no API, no login page, and no attack surface. ## How Firevault Fulfils the Offline Requirement Firevault implements disconnection at OSI Layer 1 (the physical layer). This means: - The storage hardware has no electrical connection to any network when in its default (disconnected) state. - No standby power is supplied to network interfaces between access sessions. - No wireless, Bluetooth, or radio frequency communication is available at any time. - Connection is established only after identity verification, and only for a time-limited window. - Upon session completion, the physical connection is severed and the hardware returns to its default disconnected state. Every access session is logged with the identity of the accessor, the time and duration, and what data was accessed. This creates documented evidence of appropriate technical measures under GDPR Article 32, NIS2, and CAF 4.0. 02 Comparison and RPO/RTO ## Firevault against software-defined immutable storage A layer-by-layer look at how physical disconnection compares with logical controls. ### Firevault vs Immutable Backup Vendors Capability Firevault OSS Software-Defined Immutable Storage Physical disconnection Yes (Layer 1) No Network-attached when idle No Yes Management plane access None Always available API access when idle None Available Vulnerable to credential theft No Yes Vulnerable to zero-day exploits No (no software surface) Yes Meets 3-2-1-1-0 offline requirement Yes (physical) Partial (logical only) Identity-locked access Yes (biometric + MFA) Password/SSO Audit trail of physical state Yes No Hardware encryption AES-256-XTS on device Varies ### CNI Compliance Alignment #### NIS2 Directive NIS2 requires essential and important entities to implement appropriate technical measures including risk analysis, incident handling, business continuity, and supply chain security. Physical disconnection provides the strongest form of data isolation, satisfying measures under Articles 21(2)(a) through (d). The identity-verified audit trail addresses Articles 21(2)(e) and (g) on access control and security monitoring. #### CAF 4.0 (Cyber Assessment Framework) The NCSC Cyber Assessment Framework version 4.0 assesses operators of essential services across four objectives: Managing Security Risk, Protecting Against Cyber Attack, Detecting Cyber Security Events, and Minimising the Impact of Cyber Security Incidents. Firevault directly supports Objective B (Protecting Against Cyber Attack) by removing data from network-accessible systems, and Objective D (Minimising Impact) by providing physically isolated backup copies for recovery. #### IEC 62443 IEC 62443 defines security requirements for industrial automation and control systems. Firevault supports Zone and Conduit modelling (IEC 62443-3-2) by providing a physically isolated zone with no conduits when disconnected. This represents Security Level 4 (SL4) for data at rest, the highest level defined in the standard. #### NCSC Guidance The NCSC recommends organisations maintain offline backups as part of their ransomware resilience strategy. NCSC guidance explicitly states that backups should be kept offline where possible, disconnected from the network and from the systems they back up. Firevault is purpose-built to meet this recommendation. ### RPO and RTO Characteristics Product RPO RTO Access Model LUV (300 GB) Last scheduled upload Same-day remote access One nominated access day per week Vault (300 GB - 8 TB) Last session sync Minutes (remote access) On-demand, identity-verified Storage (8 TB+) Last session sync Minutes to hours On-demand, identity-verified Enterprise (10-300 TB+) Configurable Configurable 24/7 managed access RPO and RTO depend on the product tier and access configuration. All products guarantee physical disconnection between sessions. 03 Architecture and mapping ## Architecture overview and compliance mapping How the layers separate storage from the network, and where each standard is satisfied. The Firevault architecture separates storage from all networks using a physical disconnection layer: Layer Component State When Disconnected Application Firevault Portal / API No path to storage Network Identity Verification Gateway No session active Physical Disconnect Layer 1 Air Gap Controller Electrically severed Storage AES-256-XTS Encrypted Drives No power to interfaces Audit Tamper-Evident Access Log Sealed, read-only When a verified owner initiates an access session, the Layer 1 Air Gap Controller establishes a physical connection for the duration of the session. Upon completion, the connection is severed, returning all layers above storage to their default disconnected state. ### Compliance Mapping Standard Clause How Firevault Meets It GDPR Article 32 Physical disconnection as an appropriate technical measure; identity-verified access logs NIS2 Article 21(2)(a-d) Air-gapped data copies for recovery; no network exposure during incidents CAF 4.0 Objective B Data removed from network-accessible systems; no management plane when disconnected IEC 62443 Zone/Conduit (3-2), SL4 Physically isolated zone with zero conduits when disconnected NCSC Ransomware guidance Purpose-built offline storage with physical disconnection ISO 27001 Annex A.11 Dedicated hardware in secure bunker; tamper-evident environments Cyber Essentials Plus Secure configuration Zero standing privileges; identity-locked access DORA ICT risk management Physically isolated backup for operational resilience PCI DSS Requirement 9 Identity-verified access to dedicated hardware SOC 2 Security criteria Documented access controls; audit trail evidence 04 Conclusion ## The difference between reachable and unreachable For CNI operators, the distinction between logical and physical air gaps is not academic. The 3-2-1-1-0 backup strategy requires one genuinely offline copy. Software-defined immutability does not satisfy this requirement because the storage remains network-attached and reachable through management planes, APIs, and administrative interfaces. Firevault is the only commercial storage platform that meets the offline requirement through physical disconnection at OSI Layer 1. When not in use, there is no network path, no management plane, no API, and no attack surface. This provides the strongest form of data isolation available and directly supports compliance with GDPR, NIS2, CAF 4.0, IEC 62443, NCSC guidance, and other CNI frameworks. For organisations operating critical national infrastructure or handling sensitive data, the distinction between logical and physical air gaps is not academic. It is the difference between data that can be reached and data that cannot. ### Need an evidence pack for your underwriter or auditor? Mark Fermor and the Firevault team can issue a tailored compliance mapping for your environment, with bunker access logs and a sample restore plan. [Talk to the team](/contact?subject=enterprise) [Cyber insurance angle](/compliance/cyber-insurance-3-2-1-0)