In the PCI DSS version 3 it says:
1.3.3 Do not allow any direct connections inbound or outbound for traffic between the Internet and the cardholder data environment.
But in the event of hard drive failure, fire, natural disaster, or terrorist takeover, I wouldn't want to lose the information stored there, so I researched websites that provide "secure online backup" solutions. For example: http://www.carbonite.com/, which has a pro plan for backing up "financial data, healthcare records or other crucial business files". (Note, I'm only using this as an example because they were the first result, not because I have any affiliation with them).
So it would seem that it is possible somehow. My question is, how would you get the data from the cardholder data environment and the Internet without being able to have any incoming or outgoing traffic? If I have to proxy it through another local server, wouldn't that be essentially the same thing with just another step where things could potentially go wrong in between? Along the same lines is keeping the operating system patched and up to date. That's a bit difficult to do without an active Internet connection. Are there any exceptions to the PCI DSS for pre-defined connections for purposes such as backups and operating system updates?