October DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsPC HealthRecommendedCrashes, freezes, slowdowns? Check your PC nowSpot repairable issues before they interrupt work.Check PCOctober DealsAmazon USDeal season is back - check today's better picksAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
World desk4 min

Ransomware Backups: Immutable, Offline, or Air-Gapped—Which Should You Choose?

Immutable backups resist changes, while offline and air-gapped copies limit network reachability. Learn how to combine these protections and test recovery.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Choose a combination, not a single label. Immutability helps stop a backup from being changed or deleted during a protected period; offline and air-gapped designs limit whether compromised systems can reach it. Build around your recovery needs and threat model, keep multiple protected copies—including an offline or independently isolated copy where feasible—and test that you can restore them.

What the three terms mean

These terms describe different security properties, so they are not mutually exclusive. A backup can be immutable and also kept offline; an air-gapped design can include immutable storage.

As an Amazon Associate I earn from qualifying purchases.

Approach What it protects against What it does not guarantee
Immutable Storage controls prevent alteration or deletion for a defined period or under defined conditions. This can protect a backup from ransomware or an administrator who can otherwise access the storage. It does not necessarily make the copy unreachable from compromised systems. Cloud immutability depends on configuration and may have cost or regulatory limitations, as CISA cautions in its #StopRansomware Guide.
Offline The backup is disconnected or unavailable from the production network during the relevant period, reducing the paths ransomware can use to reach it. It does not by itself prevent tampering while the copy is connected, nor does the label establish that the backup is complete or restorable.
Air-gapped An isolation arrangement is intended to keep the backup separate from ordinary network access. Depending on the design, separation can be physical or logical. The term alone does not prove that there are no access, administration, or reconnection paths back to compromised systems.

In short, immutability addresses whether data can be changed or deleted; isolation addresses whether an attacker can reach it. Assess the actual controls and access paths rather than relying on a storage label.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

How to choose a backup design

There is no universal ranking or scoring model in the cited guidance. Compare the options against the needs and risks of your own environment:

#1 Best Overall
Sale
Seagate 2TB Portable Hard Drive | USB 3.0 (STGX2000400) | Everyday HDD storage. Plug-and-play backup. Windows & macOS. Adobe CC trial included. 1-Year Warranty
  • Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
  • Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
  • To get set up, connect the portable hard drive to a computer for automatic recognition no software required
  • This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
  • The available storage capacity may vary.
  • Access and deletion: Could a compromised production system or backup administrator reach and delete the copy? Consider separate credentials, administrative paths, and network segmentation.
  • Modification during retention: Can ransomware or an insider alter the data before the retention period ends? Immutability may address this risk when its controls are correctly configured.
  • Recovery time and complexity: How quickly must systems return, and can staff retrieve and restore isolated copies under incident conditions? More isolation can add operational steps.
  • Capacity, cost, and retention: Can the design retain enough recovery points for the time your organization needs? Account for recurring storage, management, and retrieval costs.
  • Testing and monitoring: Can you detect failed backup jobs, verify data integrity, and exercise restoration procedures regularly?
  • Compliance and data location: Check the actual requirements that apply to your organization and where the data is stored. CISA notes that cloud immutable storage can be misconfigured, costly, or unsuitable for some regulatory criteria.

A practical layered approach

CISA recommends maintaining offline, encrypted backups of critical data and regularly testing their availability and integrity in a disaster recovery scenario. Its LockBit advisory recommends multiple copies in physically separate, segmented, secure locations and calls for backup data to be encrypted and immutable. These recommendations point to layered protection rather than choosing one property and treating it as sufficient.

  1. Identify what must be restored. Prioritize critical data and systems, and establish the recovery objectives the backup plan must support.
  2. Keep multiple protected copies. Separate copies by location and, where practical, by network segment and administrative access. Protect the data with encryption and controls against alteration or deletion.
  3. Include a copy that compromised production systems cannot readily reach. Keep at least one offline or independently isolated copy where feasible. For an individual or small organization making a local offline copy, CISA suggests an external hard drive and advises disconnecting it when it is not actively being used for backup. A disconnected drive is one layer, not a complete recovery architecture.
  4. Set retention and access controls deliberately. Define how long copies must be retained, who can change retention or restore data, and how isolated copies can be retrieved without reopening unnecessary access paths.
  5. Exercise recovery, not just backup creation. Verify that backup data is intact and perform restoration tests in a disaster recovery scenario. A successful backup job alone does not establish that systems can be recovered.

Adjust the design to the environment

Individuals and small organizations

A disconnected external drive can provide a simple offline copy for locally stored data. Connect it only for the backup, then disconnect and store it safely; leaving it attached gives ransomware on the device a route to it. CISA also identifies a properly vetted cloud service as an option for data stored locally, but cloud storage should not be assumed to be immutable or isolated without checking its controls.

Rank #2
Seagate Portable 5TB External Hard Drive HDD – USB 3.0 for PC, Mac, PS4, & Xbox - 1-Year Rescue Service (STGX5000400), Black
  • Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
  • Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
  • To get set up, connect the portable hard drive to a computer for automatic recognition software required
  • This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
  • The available storage capacity may vary.

Organizations with cloud or networked backups

Review the specific configuration: who can administer storage, whether compromised credentials can delete copies or change retention, and how the organization can restore data during an incident. Cloud immutability can protect data without a separate environment, but CISA warns that misconfiguration, significant cost, and regulatory criteria can limit its suitability. A cloud feature name is not a substitute for validating those conditions.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Operational technology environments

For operational technology (OT), backup practice needs to fit change management and recovery exercises. NIST’s OT Backup Quick Start Guide, published June 17, 2026, calls for backups to be created regularly, tested, and reviewed during recovery exercises, and for backup management to be integrated with change management.

Rank #3
Seagate Portable 1TB External Hard Drive HDD – USB 3.0 for PC, Mac, PlayStation, & Xbox, 1-Year Rescue Service (STGX1000400) , Black
  • Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
  • Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
  • To get set up, connect the portable hard drive to a computer for automatic recognition no software required
  • This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
  • The available storage capacity may vary.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

How often to test and review

Make restoration and integrity checks recurring activities, not steps reserved for an incident. CISA’s LockBit advisory recommends daily or weekly backup and restoration practice at minimum; that is the advisory’s recommendation, not a universal legal or technical mandate. Set a cadence that fits your systems and risks, then verify that recovery exercises include the copies and procedures you would rely on after an attack.

NIST’s 2020 guide is specifically about conducting, maintaining, and testing backup files for ransomware and other data-loss events. Its scope reinforces the practical point: recovery depends on maintaining usable files and testing them, not simply possessing storage described as immutable, offline, or air-gapped. See the NIST guide for MSPs.

Quick Recap

SaleBestseller No. 1
Seagate 2TB Portable Hard Drive | USB 3.0 (STGX2000400) | Everyday HDD storage. Plug-and-play backup. Windows & macOS. Adobe CC trial included. 1-Year Warranty
Seagate 2TB Portable Hard Drive | USB 3.0 (STGX2000400) | Everyday HDD storage. Plug-and-play backup. Windows & macOS. Adobe CC trial included. 1-Year Warranty
This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable; The available storage capacity may vary.
$129.99
Bestseller No. 2
Seagate Portable 5TB External Hard Drive HDD – USB 3.0 for PC, Mac, PS4, & Xbox - 1-Year Rescue Service (STGX5000400), Black
Seagate Portable 5TB External Hard Drive HDD – USB 3.0 for PC, Mac, PS4, & Xbox - 1-Year Rescue Service (STGX5000400), Black
This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable; The available storage capacity may vary.
$229.99
Bestseller No. 3
Seagate Portable 1TB External Hard Drive HDD – USB 3.0 for PC, Mac, PlayStation, & Xbox, 1-Year Rescue Service (STGX1000400) , Black
Seagate Portable 1TB External Hard Drive HDD – USB 3.0 for PC, Mac, PlayStation, & Xbox, 1-Year Rescue Service (STGX1000400) , Black
This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable; The available storage capacity may vary.
$119.80
Bestseller No. 4
Seagate Portable 4TB External Hard Drive HDD – USB 3.0, 1-Year Rescue | Everyday HDD storage. Plug-and-play backup. Windows & macOS. Adobe CC trial included. 1-Year Warranty
Seagate Portable 4TB External Hard Drive HDD – USB 3.0, 1-Year Rescue | Everyday HDD storage. Plug-and-play backup. Windows & macOS. Adobe CC trial included. 1-Year Warranty
This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable; The available storage capacity may vary.
$208.99
Best Value
Sale
UnionSine 500GB Ultra Slim Portable External Hard Drive HDD-USB 3.0
  • [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
  • 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
  • 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
  • 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
  • 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
Rank #4
Seagate Portable 4TB External Hard Drive HDD – USB 3.0, 1-Year Rescue | Everyday HDD storage. Plug-and-play backup. Windows & macOS. Adobe CC trial included. 1-Year Warranty
  • Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
  • Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
  • To get set up, connect the portable hard drive to a computer for automatic recognition no software required
  • This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
  • The available storage capacity may vary.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.