Ok, how often do you take it out of the safe to do periodic backups? How's access to the safe managed? What happens if you get a vindictive (ex-)employee with

Ok, how often do you take it out of the safe to do periodic backups? How's access to the safe managed? What happens if you get a vindictive (ex-)employee with access to it? If the person with access to the safe loses the key, or gets in an accident and can't open it anymore, what do you do? How do you audit access to the safe to make sure nobody's pulling down data and selling it for profit on the side? How do you make sure you don't lose all your backups by having a butterfingers IT person drop the drive? How sure are you that the latest backup doesn't contain files hit by ransomware, or worse yet, the ransomware itself? If you're storing financial or medical data about the county's citizens, how are you going to handle the possibility of being legally challenged down the line about data storage practices? Handling any data in an org of almost any size is surprisingly complicated, especially if it's other peoples' data. Most people don't realize the scale of the issue because they're coming from a place of mostly working with at-home backups. In terms of spending feasibility: really depends on how funding gets allocated by the state. Like I said in another comment, the solution would be for the state to subsidize the fixed costs of putting this kind of infrastructure in place.