---
title: "If backups are encrypted, are encryption keys stored offline?"
url: https://insuranceposture.com/questions/backup-and-recovery/backups-encrypted-encryption-keys-stored-offline
category: "Backup and recovery"
canonical_key: q_bak_011
evidence_state: partial
updated: 2026-08-24
---

# If backups are encrypted, are encryption keys stored offline?

URL: https://insuranceposture.com/questions/backup-and-recovery/backups-encrypted-encryption-keys-stored-offline
Section: Backup and recovery
Evidence state: Partly verifiable from your tenant

Backups you cannot decrypt are backups you do not have. This question exists because that discovery is usually made during a recovery.

## What the carrier is actually asking

The carrier is asking whether the key material protecting your backups survives the loss of the environment those backups protect. If the key lives only in the encrypted estate, an event that takes out the estate takes out the recovery with it.

## Why it is underwritten

Attackers who cannot delete an immutable copy will settle for making it unreadable, and the fastest route is the key vault. Beyond attack, ordinary key loss during a rebuild is a recurring cause of failed recoveries. The carrier is underwriting the ability to actually restore, and key custody is a precondition of that.

## Where the answer lives in Microsoft 365, Entra ID, and Azure

Cloud key custody is readable. Physical custody of an offline key is attested and should be documented.

| Platform | Where the setting lives | What has to be true |
| --- | --- | --- |
| Azure | Key Vault soft delete and purge protection on vaults holding backup keys | Purge protection enabled, so a deleted key can be recovered rather than being permanently gone |
| Azure | Key Vault access policies or role assignments | A short list, separate from production administration, with no standing delete rights for daily accounts |
| Azure | Key rotation policies and expiry on keys and secrets | Rotation configured, with the old key retained long enough to read older backups |
| Offline custody | Escrow, safe, or sealed envelope process for the master key or recovery passphrase | A documented custody process with named custodians and a tested retrieval path. Attested |
| Recovery plan | The step that retrieves key material during a recovery | Written down, since retrieving a key under a documented process is very different from finding it in a chat log |

**Test the retrieval, not the storage**

Key custody fails at retrieval far more often than at storage. The envelope exists and the person who knows the safe combination left the company. A custody process that has never been exercised is an assumption dressed as a control.

## What a defensible yes requires

- Key material exists outside the environment it protects, in a form that survives that environment being lost.
- Cloud key stores have purge protection, so keys cannot be permanently deleted by a compromised administrator.
- Custodians are named, plural, and current.
- Retrieval has been exercised recently and the elapsed time is known.
- Historical keys are retained long enough to read the oldest backup you would rely on.

## How this answer goes wrong

The pattern is a passphrase stored in the documentation platform hosted in the same tenant as everything else. It is protected, it is access-controlled, and it is inside the blast radius. The second pattern is rotation without retention: keys rotate diligently and the old key is discarded, so backups older than the last rotation cannot be read.

## If this answer turns out to be wrong

Backup immutability and restore testing are trivially checkable after a ransomware loss, which is why an overstated answer here is one of the few that regularly turns into a coverage argument. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [what counts as misrepresentation on a cyber application](https://insuranceposture.com/glossary/misrepresentation). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary).

## Frequently asked

### Does offline mean literally offline?

It means outside the failure domain. A sealed envelope in a safe qualifies. So does a key in a separate tenant with separate administration. What does not qualify is a key reachable with the same credentials as the data.

### Is a hardware security module required?

Not to answer this question yes. It strengthens custody and matters more where regulation or contract requires it.

### What about the backup product passphrase?

Same rule. It is key material, and it belongs in custody with named custodians rather than in the product documentation or the deployment runbook.

### How often should retrieval be tested?

At least annually, and after any change of custodian. Fold it into the restore test so both are exercised in one exercise.

## Related questions

- [Are backups encrypted?](https://insuranceposture.com/questions/backup-and-recovery/backups-encrypted)
- [Are backups kept offline (disconnected) or immutable / air-gapped?](https://insuranceposture.com/questions/backup-and-recovery/backups-kept-offline-immutable-air-gapped)
- [Have you tested the successful restoration and recovery of key server configurations and data from backups in the last 6 months?](https://insuranceposture.com/questions/backup-and-recovery/you-tested-successful-restoration-recovery-key-server-configurations-data)
- [Are backups secured with different access credentials from administrator credentials?](https://insuranceposture.com/questions/backup-and-recovery/backups-secured-different-access-credentials-from-administrator-credentials)

---

Insurance Posture by SecValley. https://insuranceposture.com
The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished.
SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact.
Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.