Government agencies, defense organizations and critical infrastructure operators face a threat most enterprises don’t. Their adversaries are nation-states: patient, well-resourced and specifically motivated to destroy the ability to recover.
They also work under constraints most businesses never see. Classification boundaries, data sovereignty mandates and strict isolation requirements put the most advanced cyber resilience tools out of reach or out of compliance. A defense agency can’t route backup telemetry through a foreign-owned cloud. An intelligence organization can’t allow recovery workflows that depend on an external connection. A European regulator won’t accept “The data is in-country” as proof that no foreign government can reach it.
For these organizations, these aren’t edge cases. They’re the baseline operating environment.
To address these unique requirements, today Rubrik is announcing new capabilities in Rubrik Security Cloud Private (RSC-P), built for organizations that can’t risk compromising on where their data lives or who controls their recovery. RSC-P is Rubrik's cyber resilience solution for highly regulated organizations and government agencies that need jurisdictional control. It delivers immutable backup protection, advanced threat detection, and petabyte-scale unstructured data protection, all within your security perimeter, with no external cloud dependencies after initial registration.
Why Legacy Solutions Fail Sovereign and Highly Regulated Organizations
Sovereign and highly regulated organizations carry threat and compliance burdens that the recovery tools built for an earlier era were never designed to meet. Attackers tried to compromise backups in 96% of attacks, and at least partly succeeded 74% of the time.¹ Federal agencies reported more than 32,000 security incidents in a single year, while more than 730 GAO cybersecurity recommendations to agencies remain open.² In Europe, 44% of organizations doubt their cloud provider can guarantee sovereignty against foreign access laws, and a third had a data sovereignty incident in the past year.³
Attackers know exactly where the gaps are and most platforms weren’t built to close these gaps from inside a sovereign perimeter. Indeed, many enterprise backup and recovery platforms were architected for the cloud era: connectivity-first, with advanced features that require external telemetry, cloud-hosted threat intelligence feeds, or vendor-managed control planes. For regulated industries and government agencies, this is a disqualifying architecture.
Data residency mandates where data sits, who can access it, under which legal framework, and what telemetry about that data leaves organizational control. RSC-P was designed to address the specific needs of public sector entities and now extends that foundation with new deployment flexibility and capabilities to protect on-premises, cloud and SaaS workloads.
Flexible Deployment Options
RSC-P supports flexible deployment form factors, running the same software stack, with no external internet dependency after registration.
The R7K physical hardware appliance is the primary option for organizations requiring maximum resilience. It provides immutability, high availability, and petabyte-scale workload coverage. RSC-P is FIPS 140-3 compliant, making it an excellent choice for dark-site, classified and large enterprise environments.
The newly enhanced VM form factor in RSC-P deploys as a VM on your existing vSphere/ESXi infrastructure, with no new hardware procurement required. For cost-sensitive environments and smaller deployments, the VM provides a fast, low-friction path to enhanced capabilities. Capabilities are gated by edition, not by deployment model, so organizations can expand as requirements grow without changing their infrastructure.
Sovereign by Design
RSC-P treats sovereignty as part of the architecture, not a setting you switch on.
The solution runs inside the customer’s own environment, operated by their own team. Backup data stays in their cluster, and metadata never leaves their boundary. After initial registration, RSC-P runs fully air-gapped, with no internet connection, no external telemetry and no dependency on a vendor’s cloud. Encryption keys stay under customer control through their own KMIP-compliant key manager, backed by FIPS 140-3 compliance.
For government deployments, RSC-P is on the DoD Information Network Approved Products List (DoDIN APL) and holds Common Criteria EAL2+ certification. It runs on a STIG-hardened operating system, and Rubrik provides a CMMC Level 2 controls analysis to support contractors’ own CMMC assessments. Together, they give agencies and their contractors a head start on authorization, without giving up control of their data.
Detect and Hunt Without Leaving the Perimeter
RSC-P delivers two distinct threat detection capabilities, both operating entirely within the security boundary.
Threat Monitoring provides always-on, continuous scanning of backup data for indicators of compromise using Rubrik threat intelligence feeds, including YARA rules and file hashes. Administrators configure it once. It automatically ingests new threat intelligence and scans new snapshots without manual intervention, providing continuous coverage without operational overhead.
Turbo Threat Hunting provides on-demand, surgical investigation. Security teams submit suspect hash values and RSC-P identifies all affected snapshots across thousands of backups in seconds, using pre-built hash catalogs. During an active incident, the difference between knowing which recovery point is clean and guessing can mean the difference between hours and weeks of downtime.
Protection at Petabyte Scale
NAS Cloud Direct protects petabyte-scale unstructured data at line speed, using a custom-built NFS/SMB client with multi-threaded parallel scanning and a globally scalable metadata index supporting billions of entries.
For regulated industries where massive volumes of file data sit outside the protection boundary of traditional backup tools, NAS Cloud Direct closes that gap without requiring changes to network architecture or additional hardware. Production-scale NAS Cloud Direct deployments require the R7K hardware appliance.
Prove You Can Recover, Before Regulators Ask
For government agencies and highly regulated institutions, saying you can recover from a system outage is no longer adequate. You must prove it.
In Europe, DORA requires financial entities to test their recovery and measure recovery times, and NIS2 makes business continuity a board-level obligation. In the US, NIST’s Cybersecurity Framework treats recovery as a core function, and inspectors expect evidence, not assurances. Most organizations can’t produce that evidence until an incident forces the question. RSC-P is built to answer it in advance.
RSC-P’s Enterprise Edition includes Cyber Recovery Simulation, so teams can test and document recovery plans before an incident, without disrupting production. Every test produces a record of what was recovered, how long it took and what was affected, which is the kind of evidence auditors and regulators increasingly expect. Sensitive Data Monitoring shows where sensitive data lives across protected workloads, so organizations can prove where regulated data sits and prioritize what to protect first. All of this runs inside the customer’s boundary, so the evidence never leaves their control either.
Sovereignty and Resilience, Without the Trade-Off
The organizations with the most to protect have long had the fewest options. Strict isolation and sovereignty requirements kept modern cyber resilience out of reach. RSC-P changes that.
Enterprise Edition is available today, bringing anomaly detection, threat monitoring and hunting, sensitive data monitoring and cyber recovery simulation entirely inside the customer’s boundary. And with the choice of a purpose-built R7K appliance or a VM on existing infrastructure, organizations of every size can deploy RSC-P the way their mission requires.
Sovereignty and resilience aren’t competing goals. They demand the same things: control, isolation and the ability to recover clean. RSC-P is how Rubrik delivers both.
To see how RSC-P fits your environment, request a briefing with a Rubrik representative.
Resources:
The State of Data Security: Measuring Your Data’s Risk. Rubrik Zero Labs, May 2024, www.rubrik.com/content/dam/rubrik/en/resources/report-review/rpt-zero-labs-4.pdf.
“Cybersecurity.” U.S. Government Accountability Office, www.gao.gov/cybersecurity.
2026 Data Security and Compliance Risk: Data Sovereignty Report. Kiteworks, Feb. 2026, www.kiteworks.com/sites/default/files/resources/kiteworks-report-2026-data-sovereignty-compliance-incidents.pdf.