Air-gapped backup
A backup copy kept physically or logically disconnected, unreachable from the production network.
Traditionally this meant tape in a safe. The modern equivalent is a copy in a separate cloud account with independent credentials, or storage that is only connected during the backup window.
The point is that an attacker who owns your entire network still cannot reach it, which is a stronger guarantee than any permission model on a connected system.
Where this comes up
Air-gapped backup sits inside our backup and disaster recovery work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.
Related terms
Immutable backup A backup that cannot be modified or deleted for a defined period, even by an administrator. Offsite backup A backup copy kept at a different physical location from the systems it protects. 3-2-1 rule Keep three copies of data on two different media, with one copy offsite. Ransomware Malware that encrypts your files and demands payment for the key, now almost always combined with stealing the data first.