--- title: "Are backups encrypted?" url: https://insuranceposture.com/questions/backup-and-recovery/backups-encrypted category: "Backup and recovery" canonical_key: q_bak_003 evidence_state: partial updated: 2026-08-24 --- # Are backups encrypted? URL: https://insuranceposture.com/questions/backup-and-recovery/backups-encrypted Section: Backup and recovery Evidence state: Partly verifiable from your tenant Almost everyone answers yes, and almost everyone is right. The question that carries the risk is what protects the keys. ## What the carrier is actually asking The carrier is asking whether backup data is unreadable to someone who obtains the media or the storage: encryption at rest for stored copies and in transit while they move. In modern platforms this is largely default, which is why the meaningful part of the answer is key custody rather than the encryption itself. ## Why it is underwritten Unencrypted backups turn a theft or a misconfigured storage bucket into a full data breach without any need to touch production. For regulated data, encryption also changes the notification calculus in several jurisdictions, which is a direct cost to the carrier. Because the control is nearly free, its absence reads as a broader hygiene problem. ## Where the answer lives in Microsoft 365, Entra ID, and Azure Encryption state for cloud-resident data is directly readable. Backup product encryption is attested. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Azure | Storage account encryption, and infrastructure encryption for double encryption at rest | Encryption at rest enabled, with infrastructure encryption for the most sensitive datasets | | Azure | Customer-managed keys on storage accounts holding critical data | Where you have chosen customer-managed keys, the key is in a vault with purge protection and a rotation policy | | Azure | Secure transfer required, and minimum TLS version on storage accounts | In-transit protection enforced rather than optional | | Azure | Disk encryption on virtual machines and unattached disks | Disks encrypted, including the unattached ones left behind by decommissioning, which are a common quiet exposure | | Backup product | Encryption settings and passphrase or key custody | Encryption enabled and the key held somewhere other than inside the system being backed up. Attested | **Where is the key** An encrypted backup whose key lives in the environment being backed up is encrypted against theft of the media and not against the incident you actually fear. Key custody is the part of this answer that changes outcomes, and the related question about offline key storage exists for exactly that reason. ## What a defensible yes requires - Backups are encrypted at rest and in transit as a matter of configuration, not assumption. - Keys are held outside the systems being backed up, with a documented custody arrangement. - Key stores are protected against deletion, so an attacker cannot make backups unreadable rather than deleting them. - Key rotation exists and has been exercised, since an unrotated key is a credential that never expires. - Unattached and legacy disks are covered, because decommissioning leaves encrypted-by-default gaps. ## How this answer goes wrong The answer is rarely wrong and often shallow. Organisations confirm encryption and cannot say who holds the keys, where the passphrase is, or what happens if the person who set it up is unavailable. In a real recovery that becomes the blocking issue: the backups are intact, encrypted, and nobody can open them. ## If this answer turns out to be wrong Backup immutability and restore testing are trivially checkable after a ransomware loss, which is why an overstated answer here is one of the few that regularly turns into a coverage argument. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [what counts as misrepresentation on a cyber application](https://insuranceposture.com/glossary/misrepresentation). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Is platform default encryption enough? For this question, generally yes. Platform-managed encryption at rest is an accepted answer. Customer-managed keys become relevant when regulation or contract requires key separation. ### Does encryption help after ransomware? Not against the encryption itself. It matters for the exfiltration half of a double-extortion event, where stolen backup data is worthless if the attacker cannot read it. ### Where should backup keys live? In a key vault with purge protection, outside the environment being backed up, with a documented emergency access path. A passphrase in the same tenant as the data is not custody. ### What about tape? Hardware encryption on the drive with keys held separately is the standard answer, and the key custody question applies with more force, because tape outlives the people who configured it. ## Related questions - [If backups are encrypted, are encryption keys stored offline?](https://insuranceposture.com/questions/backup-and-recovery/backups-encrypted-encryption-keys-stored-offline) - [Are backups kept offline (disconnected) or immutable / air-gapped?](https://insuranceposture.com/questions/backup-and-recovery/backups-kept-offline-immutable-air-gapped) - [Is sensitive data encrypted in transit?](https://insuranceposture.com/questions/data-handling/sensitive-data-encrypted-transit) - [Is data encrypted at rest on endpoints (laptops, desktops, portable devices)?](https://insuranceposture.com/questions/endpoint-and-patching/data-encrypted-at-rest-endpoints) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.