Claims Retention and Air Gap with a Shared PPDM
A healthcare payer must retain claims backups for seven years. Operations need 35 days of fast restores; compliance requires 12 months of immutable copies and an isolated recovery environment. The current design sends PPDM backups to a DD9400 at the primary site and replicates to a DDVE in a cloud region. The cloud DDVE is managed by the same PPDM instance and is reachable over a VPN. An auditor asks whether this satisfies an air gap and immutability. The security team can provide a separate vault network, a jump host, and a one-way replication window, but no second PPDM license is funded. Restore testing is quarterly and must prove a 24-hour RTO for a 10 TB Oracle database. The team asks for a target architecture, retention design, and restore validation plan.
1. Judge whether the current cloud DDVE design meets the air gap and immutability requirements.
Read the worked answer
No. A cloud DDVE reachable over VPN and managed by the same PPDM is replication, not an air gap. An attacker with PPDM or network access could delete or encrypt both copies. Replication alone also does not prove immutability; retention lock must be enabled on the target. The 12-month immutable requirement needs a separate credential boundary and a vault path that is not always-on. If no second PPDM is funded, use a cyber recovery vault with a jump host and a separate DD management account, and automate one-way replication into the vault. Keep the 35-day operational copy separate from the vault copy. Document that the vault DD must not be joined to the primary PPDM domain if that would create a deletion path.
2. Design the retention tiers and explain how PPDM and DD retention settings must align.
Read the worked answer
Use three tiers: 35 days on the primary DD for fast restores; 12 months immutable in the vault with retention lock in compliance mode and restricted delete; seven years in archive or cloud tier with encryption and indexed catalogs. The PPDM policy sets backup retention, while the DD retention lock sets a minimum retention. Align them so PPDM cannot expire a copy before the DD lock allows it. For the 10 TB Oracle database, use a weekly full plus incrementals with a validated restore chain. The vault copy must become immutable before the replication window closes. Do not rely on cloud tier alone for air gap, because tiering is a storage destination, not an isolation boundary.
3. Define the quarterly restore validation that proves the 24-hour RTO.
Read the worked answer
Restore from the vault, not the primary, to an isolated host. Select a 10 TB Oracle backup, recover to a point in time, open the database, and run application verification. Measure elapsed time from restore start to verified database, including staging and network transfer. Record chain dependencies, throughput, and any missing logs. Also test a scenario where the primary PPDM and primary DD are unavailable, using vault procedures. If the restore exceeds 24 hours, adjust the runbook or add staging capacity before the next quarter. Keep signed evidence for the auditor.