Direct answer
An offline copy is useful only if the organization can locate it, unlock it and rebuild the catalog under incident conditions. Design the custody process, key recovery and quarterly sample restore at the same time as the media rotation; otherwise the air gap becomes an untested archive.
How to frame the decision
Architecture decisions should be evaluated against shared failure domains. Geographic distance alone does not create independence when identities, management tools or deletion privileges are shared.
For this decision, document the protected service, assumed compromise, required recovery point and the maximum acceptable time to a trusted business state. Keep product capability, configured capability and tested capability as three separate fields: they are rarely identical.
Decision table
The following factors convert the decision into requirements that can be reviewed, tested and retained as evidence.
| Factor | Practical guidance | Evidence to retain |
|---|---|---|
| Media rotation | Define which recovery points leave online control and when they return for reuse. | A custody log with media identifiers, dates and responsible people. |
| Catalog portability | Store enough catalog and software information to recover without the primary backup server. | A clean-room catalog import or documented manual discovery test. |
| Key escrow | Protect encryption keys separately while ensuring two authorized responders can retrieve them. | A witnessed key-recovery exercise from the documented escrow path. |
Validation procedure
Run this procedure in a non-production or isolated recovery environment. Define a named owner and time limit before the test begins.
- Draw the actual trust and data flows before changing controls.
- Translate the requirement into a pass/fail test for offline backup design without an unrecoverable operational burden.
- Capture timestamps, logs, restored-object counts and operator actions for each decision factor.
- Repeat the test with one dependency unavailable so the result reflects a hostile recovery, not a clean demo.
A pass means the recovery outcome and supporting evidence meet the pre-declared requirement. A partial restore, undocumented manual workaround or result that depends on an unavailable production service should be recorded as an exception—not rounded up to a success.
Common failure modes
These conditions can make a compliant-looking design unusable during an actual recovery.
- Media is offline but the only catalog remains on the compromised backup server.
- Keys are protected so aggressively that incident responders cannot retrieve them.
- Rotation gaps leave the newest offline recovery point outside the required RPO.
Failure modes should become tabletop injects and technical tests. If the team has never performed the recovery while one normal dependency is unavailable, the runbook describes a best-case restore rather than a ransomware recovery.
Evidence checklist
Keep this evidence with the recovery plan so that a reviewer can distinguish a documented capability from a reproduced result.
- Record the design decision, owner, exception and next test date.
- A tested requirement exists for: Media rotation.
- A tested requirement exists for: Catalog portability.
- A tested requirement exists for: Key escrow.
- Evidence includes a date, environment, operator and reproducible procedure.
- The exception path identifies who can accept residual risk.
Frequently asked questions
These answers state the decision in plain language and preserve the conditions that can change it.
What should be stored with an offline backup?
An offline copy is useful only if the organization can locate it, unlock it and rebuild the catalog under incident conditions. Design the custody process, key recovery and quarterly sample restore at the same time as the media rotation; otherwise the air gap becomes an untested archive. The deciding factors in this guide are media rotation, catalog portability, key escrow.
How do you recover a backup catalog after ransomware?
Treat the answer as conditional on the actual environment and plan. Store enough catalog and software information to recover without the primary backup server. Retain a clean-room catalog import or documented manual discovery test.
How often should offline backups be tested?
Do not rely on the product label or a successful backup job alone. Test the requirement directly: protect encryption keys separately while ensuring two authorized responders can retrieve them. Record the result with a date, operator and named exception owner.