Zero Trust Data Resilience (ZTDR) is a model for applying Zero Trust security to backup and recovery. Veeam introduced it in November 2023 with Jason Garbis of Numberline Security, as an extension of the US CISA Zero Trust Maturity Model. Its starting point is blunt: assume any network or connection could be compromised, the backup server included, and design so that the backups survive anyway.
View the data behind this chart
| Layer | Detail |
|---|---|
| Production | Workloads; assume an attacker is already here |
| Backup software | Veeam server and proxies; its own security domain |
| Immutable copy on site | Hardened Repository or Object Lock storage |
| Second zone | Another site, cloud vault or tape |
| Verified restores | The 0 in 3-2-1-1-0: tested, with evidence |
Why backups needed their own Zero Trust model
Zero Trust replaced the idea of a trusted internal network with explicit verification of every user, device and connection, under the assumption that a breach will happen. The frameworks that popularised it, such as CISA’s maturity model, concentrate on identity, devices, networks, applications and data. Backup and recovery systems barely feature, even though they are a favourite target.
Backup infrastructure is hard to protect because of what it must do. As Numberline’s Jason Garbis put it when the model launched, it needs read and write access to production across virtually every application and data source, on-premises and in the cloud, so it has a large attack surface. If an attacker controls the backup software, they can disable jobs, change retention and delete restore points. ZTDR exists to make sure that, even then, a clean copy remains.
The five ZTDR principles
The original ZTDR announcement listed five principles, extending the Data pillar of CISA’s model to backup and recovery. Veeam’s release names them and points to the Veeam and Numberline white paper for the formal model. What follows is our reading of what each means for a backup estate, not Veeam’s wording.
- •Least privilege access: backup service accounts, repository credentials and administrator roles get only what their job needs, with separate credentials for backup software and backup storage, and multi-factor authentication on both.
- •Immutability: at least one copy that nobody, including an administrator, can alter or delete before a set date. See immutable backups explained.
- •System resilience: the backup system keeps working when one part of it fails or is compromised, which means more than one copy and more than one location.
- •Proactive validation: backups are tested and restores rehearsed before they are needed, so you find a broken chain on a quiet Tuesday rather than during an incident.
- •Operational simplicity: security that depends on complex manual hardening tends to drift; designs that are secure by default are more likely to stay secure.
The three pillars Veeam describes today
Veeam’s current guidance, in its ZTDR blog updated in June 2026, condenses the model into three core principles. Object First, which Veeam acquired in January 2026, uses the same three as the pillars of its own security design.
- •Separate backup software from backup storage, with segmentation and, where possible, an air gap, so that losing the backup server does not mean losing the backups. Veeam lists physical isolation such as rotated tape, and logical techniques such as immutable snapshots replicated at the storage layer.
- •Multiple resilience zones, following the 3-2-1 rule: three copies, on two types of media, one offsite. Object First’s Trust Center frames this pillar as support for the 3-2-1-1-0 rule, which adds one immutable or offline copy and zero errors.
- •Immutable and encrypted backup storage. Veeam is clear that immutability protects integrity and availability but not confidentiality: an attacker who can read a backup can still steal it, which is what encryption, ideally with keys in a separate key management system, is for.
How the five principles and three pillars fit together
In our reading, the two lists are not competing versions. The five principles describe what a resilient backup system should achieve; the three pillars describe the architecture that gets you there. The 2023 announcement already pointed this way: alongside the principles, Numberline published a reference architecture whose key attributes were segmentation of the backup software and backup storage layers into distinct resilience zones, and backup storage immutability.
Read that way, least privilege and segmentation are the same idea at two levels: who can do what, and which systems can reach which. Immutability and encryption are the storage pillar. System resilience is the multiple-zones pillar. Proactive validation is the 0 in 3-2-1-1-0. Operational simplicity favours designs that stay secure without constant manual hardening, whether that is a prepared appliance image or a vendor-hardened target.
What ZTDR looks like in a Veeam estate
For a typical Veeam Backup & Replication deployment, ZTDR translates into a handful of concrete decisions. The backup server and its repositories sit in separate security domains, even if they share a network: Veeam reaches the repository through a narrow interface such as S3 with its own access key, or through single-use or certificate credentials on a Hardened Repository, rather than through a domain-joined Windows share.
The primary repository is immutable. Two common routes are its software-defined Hardened Repository on a Linux server kept off the Windows domain, or object storage with Object Lock such as an Object First Ootbi appliance. A second copy goes to another zone, tape, a second site or a cloud vault, and Veeam’s guidance is that it should be immutable too. Backups are encrypted in the job. And restores are tested on a schedule, with the results kept as evidence.
One detail catches people out. On object storage, the lock can last longer than the immutability period you set: Veeam’s block generation extends locks by up to 10 days on S3-compatible storage, and when immutability follows job retention, data is kept for the longer of the two plus those days. That is good for resilience and needs planning for capacity. Our sizing guide for immutable object storage works through the numbers.
ZTDR and regulation
ZTDR is a vendor-led model, not a standard or a legal requirement, and following it does not certify anything. It is useful because it maps neatly onto what regulators increasingly ask for: demonstrable, recoverable, tamper-resistant backups. Veeam’s own FAQ says the immutable storage, encryption and multiple resilience zones help meet requirements for data retention, integrity and confidentiality. For the UK and EU picture, see NIS2, the CSR Bill and immutable backup.