Physical or logical separation between backup data and the systems or networks that could compromise it.
A traditional air gap is created by writing backups to removable media, such as tape, and disconnecting that media from the network. Malware cannot directly reach storage that has no active network connection.
Cloud storage can provide a virtual air gap through immutability controls such as Object Lock. The data remains online and accessible, but authorized users, applications, and attackers cannot modify or delete it during the retention period.