Are physical backups taken off-site (i.e., physically moved off site)?

This question is asking whether your organization physically transports backup media (like tapes, hard drives, or other storage devices containing backup data) to a different location than where your primary systems operate. Why this matters for security: 1. Disaster recovery: If your primary data center experiences a catastrophic event (fire, flood, etc.), having backups stored at a different physical location ensures you can still recover your data. 2. Geographic separation: Physical distance between primary systems and backups protects against regional disasters affecting both locations simultaneously. 3. Defense in depth: Off-site backups provide an additional layer of protection against both physical threats and certain types of cyber attacks (like ransomware that might spread through your network). This question is asked because organizations with mature security practices typically implement a backup strategy that includes geographic separation of backup media. It's a fundamental disaster recovery control and helps ensure business continuity. When answering this question: - Be specific about whether physical backups exist and if they're transported off-site - If applicable, mention the frequency of off-site transport (daily, weekly, etc.) - You might describe the security controls for the transport process and storage location - If you don't use physical backups but instead use cloud backups with geographic redundancy, explain this alternative approach