CISA's ransomware guide recommends keeping offline, encrypted backups of critical data and testing them regularly. The reason is stated plainly: many ransomware variants try to find and delete or encrypt accessible backups so that you cannot restore. A backup the attacker can reach is not a safe copy.
What CISA says
The guide advises maintaining offline, encrypted backups of critical data, and says to test backup procedures on a regular basis. It also recommends regularly testing the availability and integrity of backups as part of disaster recovery. During recovery, restore from offline encrypted backups by priority of critical services, and take care not to reinfect clean systems.
On cloud immutability, the guide notes that some cloud vendors offer immutable storage but advises using it with caution. It does not describe specific isolation methods beyond the word offline.
Checklist
Scope
- List the systems and data you could not run the business without.
- Decide how recent each backup must be and how long you can be down. Write both down.
Protection
- Keep at least one copy that is not reachable with the credentials of your production environment.
- Encrypt backups, and store the keys somewhere that survives losing the backup site. See what happens if you lose the key.
- Consider write-once storage for a copy. See S3 Object Lock modes.
- Limit who can delete backups, and require a second person for deletion where tooling allows.
Detection
- Alert on failed jobs, unusual deletions and changes to retention settings.
Recovery
- Keep restore instructions offline and printed or otherwise reachable when systems are down.
- Practice. See a backup restore drill.
Common gaps
- Backup servers joined to the same directory as production, so one stolen admin account reaches both.
- Backups encrypted, but the key stored on the same server.
- Never restored once, so nobody knows how long it takes.
- Immutable settings with a retention too short to outlast a slow breach.
A realistic recovery order
CISA says to restore by priority of critical services, so decide the order before you need it. Identity and directory services usually come first because everything else depends on them. Then the systems that earn money or keep people safe, then supporting systems. Write down dependencies, such as which database each application needs, and who may approve a restore to a clean network. Plan the clean room too: a place to restore and inspect data before it rejoins the production network, because the guide warns about reinfecting clean systems. Practicing this order in a drill is cheaper than inventing it during an incident.
Quick check
Is a cloud snapshot an offline backup?
Not necessarily. If an attacker with your cloud credentials can delete it, it is not offline in the sense CISA means. Consider a copy under separate credentials or write-once protection.
Do backups need encryption if they are offline?
CISA recommends encrypted backups, since offline media can still be lost or stolen.
Sources
Last reviewed: 19 October 2026.
