If you can't store backups offsite, then maybe you can create a disaster proof area onsite. Put the backups in a high quality fire proof safe inside a large en

If you can't store backups offsite, then maybe you can create a disaster proof area onsite. Put the backups in a high quality fire proof safe inside a large enclosure built of firebrick, which is inside a steel shell, etc. It would cost a lot but if both no-offsite and backups-for-recovery are part of the requirements that might be one way to do it. The backup vault could even be a separate building, maybe buried in the ground away from the main building, but still within an enforced security perimeter. It won't be proof against some things (direct hit by a big missile/bomb for example unless you bury it very deep), but it would be better than nothing. Each time you move disks in/out of the vault you would be risking the vault integrity, so you might need two vaults. Also do some web research on "data diode" as a way to prevent exfiltration if you must have network connectivity to the backup drives. If only one signed piece of software can write to the backup disks and the data can only flow one direction (to the disks) then if you can trust the security of that system your backups might be relatively safe, at least from being encrypted by ransomware. Corruption of the original data would still be a problem. Which is a big flaw in using backups for protection. If the main system is corrupted and the corruption gets into the backups then you're compromised anyway. So a way to detect data corruption before you do a backup would be useful. If that's not possible then backups become essentially useless. You could keep very old backups forever and they might not be corrupted, but they would not be very useful because they would be so out of date. If you design all transactions to be reversible perhaps you can assume that after an attack you could figure out the nature of the corruption and reverse just those transactions, but I wouldn't count on that. An attacker does not have to actually encrypt your data, just copy it and then destroy your ability to use the data you have, and if they are sneaky about it you won't discover it until it is too late and all your current backups are also corrupted. I haven't seen this kind of attack yet, probably because simple ransomware is already so effective. If countermeasures against current ransomware become effective then ransomware may evolve. In truth, if it is important, you need a detailed security analysis of the entire system to guide the backup strategy, not some quick hack.