Are physical backups taken off-site (i.e., physically moved off site)?
Explanation
Off-site backup handling is the concern: this asks whether you physically move backup media, such as tapes or drives, to a location separate from where your primary systems run.
Why this matters for security:
- Disaster recovery: If your primary data center experiences a catastrophic event (fire, flood, etc.), having backups stored at a different physical location ensures you can still recover your data.
- Geographic separation: Physical distance between primary systems and backups protects against regional disasters affecting both locations simultaneously.
- Defense in depth: Off-site backups provide an additional layer of protection against both physical threats and certain types of cyber attacks (like ransomware that might spread through your network).
This question is asked because organizations with mature security practices typically implement a backup strategy that includes geographic separation of backup media. It's a fundamental disaster recovery control and helps ensure business continuity.
When answering this question:
- Be specific about whether physical backups exist and if they're transported off-site
- If applicable, mention the frequency of off-site transport (daily, weekly, etc.)
- You might describe the security controls for the transport process and storage location
- If you don't use physical backups but instead use cloud backups with geographic redundancy, explain this alternative approach
Example Responses
Example Response 1
Yes, our organization takes physical backups off-site on a weekly rotation schedule We use encrypted backup tapes that are transported via a secure courier service to a commercial data vault facility located approximately 30 miles from our primary data center The facility maintains 24/7 security, climate control, and fire suppression systems Access to our backup media at the facility requires dual authentication and all access events are logged The chain of custody for backup media is documented during transport and verified upon arrival at the storage facility.
Example Response 2
No, we do not transport physical backups off-site Instead, we implement a cloud-based backup strategy where all production data is backed up to two geographically separated cloud regions (US-East and US-West) with different availability zones Our backup data is encrypted both in transit and at rest using AES-256 encryption The cloud provider maintains physical security of these facilities, and we maintain logical access controls to the backup systems This approach provides geographic redundancy without the need to physically transport media.
Example Response 3
No, currently all our backup tapes are stored in a secure room within our primary data center While the backup media is encrypted and the storage room has restricted access controls, we recognize this represents a single point of failure in our disaster recovery strategy We are in the process of implementing an off-site backup solution and have contracted with a secure storage vendor We expect to begin transporting weekly full backups off-site within the next 60 days as part of our security program enhancement initiatives.
Context
- Tab
- Product
- Category
- Data
Related questions
- Will the institution's data be stored on any devices (database servers, file servers, SAN, NAS, etc.) configured with non-RFC 1918/4193 (i.e., publicly routable) IP addresses?
- Is the transport of sensitive data encrypted using security protocols/algorithms (e.g., system-to-client)?
- Is the storage of sensitive data encrypted using security protocols/algorithms (e.g., disk encryption, at-rest, files, and within a running database)?
- Do all cryptographic modules in use in your solution conform to the Federal Information Processing Standards (FIPS PUB 140-2 or 140-3)?
- Will the institution's data be available within the system for a period of time at the completion of this contract?
- Are ownership rights to all data, inputs, outputs, and metadata retained even through a provider acquisition or bankruptcy event?
