Digital Sovereignty Starts with On-Prem Backup Data Storage

When attackers get in, they often go straight for your backups. According to IDC's new Spotlight paper, Data Sovereignty Starts with Storage: A Foundation for Cyber-Resilience, "in nearly half of ransomware cases, attackers attempt to delete or corrupt backup copies themselves, specifically to prevent victims from recovering without paying a ransom" (page 2).

That puts backup storage at the center of two conversations at once: cyber-resilience and digital sovereignty.

Interest in digital sovereignty is climbing fast. Nearly three in four organizations (73%) told IDC that their interest in digital sovereignty solutions has grown since early 2026, with geopolitics, economic issues, and shifting regulations as the leading reasons.

It also makes the case that backup data is where that protection effort should start. In this blog, you’ll learn what IT and compliance leaders need to know, including:

• Why digital sovereignty depends on backups that can survive an attack

• What organizations want from sovereign storage, by the numbers

• Why backup is the workload to keep on premises, even in a hybrid strategy

• How Absolute Immutability keeps backups out of attackers’ reach

Sovereignty means nothing if your data can't survive an attack

The term digital sovereignty refers to an organization’s full span of control across its technology stack, workforce capabilities, and external dependencies. It means having digital autonomy in platforms, infrastructure, software supply chains, and operational decision making.

Data sovereignty is a subset of that broader construct. It refers specifically to legal jurisdiction and ownership: data is subject to the laws of the country in which it is collected, processed, or stored, and the organization retains authority over how that data is governed and accessed.

The IDC study draws a hard line between security and sovereignty: "An organization can be secure without being sovereign, but it cannot be sovereign without also being secure" (page 2).

For backup and recovery, the IDC study breaks cyber-resilience into three parts: your data survives, your data stays intact, and you can recover fast.

An organization needs to have all three pieces of the puzzle in order to claim the term “sovereignty.” The IDC study also calls out "sovereign washing": promising sovereignty without the controls to back it up.

Storage is where control becomes concrete

Organizations see the storage of backup data as a priority for digital sovereignty. "91% of organizations rate applying sovereign controls to their storage infrastructure specifically as important or extremely important, a higher proportion than for several other layers of the stack" (page 3).

What they want from a sovereignty-aligned partner points toward keeping tight control over data:

• Country-level cybersecurity and cloud certifications (36%)

• Ownership of in-country datacenters (31%)

• IT risk management solutions (30%)

• The ability to move data from the cloud back on premises (27%)

The last three get simpler when your data already sits in a location you control.

The study also ranks the biggest benefits organizations have seen from sovereign cloud storage. In IDC's view, on-premises backup storage delivers every one of them at least as well:

Top sovereign cloud benefit	Share	How on-premises backup delivers it
Data residency and localization	43%	Backup copies stay on your premises
Enhanced data security and privacy	41%	Locked, access-restricted copies that never share space with other cloud customers
Protection from data requests outside your jurisdiction	35%	No third-party provider or foreign jurisdiction involved
Greater control over data access	34%	Your IT team sets the rules, not a provider
Greater control over data transfers	27%	Your IT team manages transfers directly

Keep your cloud strategy. Bring your backups home.

The IDC study sees no conflict between data sovereignty and cloud adoption. Most organizations run hybrid environments and will keep doing so.

The trend IDC study expects to stick is selective placement. Most data can remain in a hybrid or cloud-first placement, while a few high-stakes workloads move on premises, with backup and recovery at the top of the list.

The reasoning behind this is simple. Backup data is what organizations rely on in the event of a cyberattack or ransomware incident. Therefore, keeping backup data on premises can speed up recovery, reduce exposure by keeping copies out of shared cloud environments, and put control in the hands of your company’s IT team without waiting on a provider.

Location alone isn't enough, though. The IDC study says on-premises storage has to bring its own encryption and Secure by Design immutability. The goal is "an always available, secure, immutable storage layer built for instant recovery" (page 3).

Absolute Immutability: backups attackers can't touch

Attackers who steal privileged credentials know this, too. They often go after the backup environment first because eliminating access to it forces an organization to pay the ransom.

Object First built Ootbi so that you never have to pay the ransom. Ootbi is a backup storage appliance that’s purpose built for Veeam and designed to be secure, simple, and powerful. It ensures Absolute Immutability: once data is written, it cannot be altered or deleted by anyone, including administrators or attackers with compromised credentials. The three pillars of Absolute Immutability are S3 Object Storage, Zero Time to Immutability, and a Target Storage Appliance.

These map directly to IDC's requirements: "A securely separated, immutable repository helps ensure backup copies cannot be deleted or tampered with, and recovery from an on-premises copy will often be faster than from a cloud source" (page 4).

Here’s how we believe each pillar fulfills the IDC requirements:

• S3 Object Storage: Immutability is built into the S3 protocol. Object First uses S3 Object Lock in Compliance Mode, which means no one can change or delete a backup during its retention period. S3 Versioning adds another layer of security by saving every change as a new version, while earlier locked versions remain untouched.

• Zero Time to Immutability: Backups are locked the moment they're written. That leaves no window for attackers, malware, or insiders, even if credentials are stolen.

• Target Storage Appliance: Ootbi's storage is physically separate from the Veeam software, which shrinks the attack surface. Copies are also kept in separate resilience zones, which guards against system failures and disasters.

The IDC study names cost (35%) and complexity (33%) as the top obstacles to sovereignty-aligned infrastructure. Object First tackles complexity head-on:

Flexible buying options: Object First offers two subscription models to fit user budgets

• CapEx: Purchase Ootbi up front as a capital expense and own it, with software, OS updates, support and on-site service covered for a fixed term of up to five years.

• Consumption: Pay a predictable monthly subscription for the storage you use, starting at 10TB, with no upfront cost and hardware refreshes, updates, support and on-site service included.

Simple Setup: Ootbi is deployable in 15 minutes with no security or Linux expertise required.

At Object First, we offer additional layers of protection and recovery:

• Honeypot: A decoy Veeam server that lures attackers probing your network and gives IT an early warning before production systems are hit.

• Fleet Manager: Cloud-based monitoring that shows every appliance in one view.

Ootbi provides users with local control over their backup data, including who can access, modify, or delete it. That's digital sovereignty you can recover with.

Want to get the full picture? Download the IDC Spotlight, Data Sovereignty Starts with Storage: A Foundation for Cyber-Resilience, for the complete survey data and analysis.

IDC Spotlight, sponsored by Object First, Data Sovereignty Starts with Storage: A Foundation for Cyber-Resilience, #US54902126, September 2026