Cohesity customers have two key building blocks for cyber resilience: DataLock for WORM-style immutability and FortKnox for an isolated, cloud-hosted vault. Used together, they address both tampering and reachability.
DataLock
DataLock applies WORM policies so that protected snapshots cannot be modified or deleted before their retention expires. Policy design matters: retention needs to be long enough to cover attacker dwell time.
FortKnox
FortKnox is a SaaS vaulting service that keeps an isolated copy of data in a separately managed environment, adding distance between production credentials and your last-resort copy.
Planning considerations
- Which workloads justify vaulting, and at what frequency?
- How long should vaulted copies be retained?
- How will you recover from the vault, and how often will you test it?
- Who holds the authority to change policies?
Designing your Cohesity protection tiers
A practical design separates operational recovery from last-resort recovery. Local snapshots with DataLock cover everyday restores and the most likely ransomware scenarios. A vaulted copy covers the worst case, when the primary cluster or its credentials cannot be trusted.
Document which workloads are vaulted, the frequency and retention for each, and the steps and approvals required to recover from the vault. Then run a recovery from the vault into an isolated environment at least annually so the procedure is proven, not theoretical.
Key takeaways
- DataLock protects copies from change; vaulting protects them from reach.
- Retention and access policies are as important as the features.
- Test recovery from the vault, not just the backup.
Want an independent view of your recoverability?
Book a Recovery Readiness Call and we’ll help you turn assumptions into evidence.
