What is Immutable Backup?
An Immutable Backup is a backup copy that is locked against modification and deletion for a defined period, so that neither an attacker, a malfunctioning process, nor an administrator with stolen credentials can alter or erase it. The data can be read and restored at any time, but it cannot be changed until the retention window expires.
Immutability is enforced by the storage system rather than by policy. Cloud object storage offers a write-once mode, often called object lock, in which each backup file is stamped with a retention date and the platform refuses delete or overwrite requests until that date. Some backup appliances provide the same guarantee on local hardware using a hardened operating system with no remote administrative access. A related approach is the air gap, where a copy is kept physically or logically disconnected from the network. Good backup design follows the 3-2-1 pattern: three copies, on two types of media, with one off-site, and at least one of those copies immutable.
The reason this matters to a small or mid-sized business is that modern ransomware groups look for backups first. They delete cloud backup jobs and encrypt the file shares where copies are kept, then trigger encryption once the safety net is gone. An immutable copy survives all of that. It also protects against quieter failures, such as a script that overwrites good backups with bad ones for weeks before anyone notices. Microsoft 365 data needs the same treatment; Microsoft retains deleted items briefly but does not provide long-term backup, so a separate immutable copy of mailboxes and SharePoint is part of a complete plan.
NetSys builds immutable backups into the disaster recovery planning that is included with every managed agreement, covering on-premises servers and Microsoft 365 through its Microsoft 365 backup service. Restores are tested rather than assumed. In the ransomware incidents NetSys has handled over the past three years, every client was fully recovered, and the ones with a disaster recovery plan in place, including protected backups, were operating again within 24 hours.
Why it matters for a small business
A backup that an attacker can delete is a backup you do not have. The first thing a ransomware operator does after gaining administrator rights is find and destroy the copies, and a surprising number of small businesses discover this only when they go to restore. Immutability removes that option from the attacker entirely. It costs little more than ordinary storage, and it is the single feature that decides whether a ransomware incident is a restore job or a negotiation. If your provider cannot tell you which backup copy is immutable and for how long, ask again until they can.
Immutable Backup: FAQs
What is an immutable backup?
An immutable backup is a stored copy of data that cannot be changed or deleted for a fixed period, enforced by the storage platform itself rather than by user permissions. Even an administrator account, or an attacker who has taken one over, cannot remove it before the retention date. The data remains available to restore at any time. The design exists specifically to defeat ransomware, which routinely deletes ordinary backups before encrypting production systems.
Why are immutable backups important for ransomware?
Because ransomware groups target backups deliberately. After gaining administrative access they delete backup jobs and encrypt the shared folders holding copies, so that the victim has no alternative to paying. An immutable copy cannot be deleted or encrypted by anyone during its retention window, which means a clean restore point survives no matter what the attacker does. Businesses with an immutable backup and a rehearsed recovery plan can rebuild instead of negotiating with a criminal.
Does Microsoft 365 back up my data?
Only in a limited way. Microsoft keeps deleted emails and files in recycle bins and retention holds for a period, and it protects its own infrastructure against failure, but it does not offer a point-in-time backup you can restore from after a ransomware attack or a malicious deletion. Microsoft's shared responsibility model places responsibility for backing up your data on you. A third-party backup with immutable storage covers mailboxes, OneDrive, SharePoint, and Teams.
More terms
Managed Detection and Response (MDR)
Managed detection and response (MDR) is an outsourced security service whose analysts monitor endpoints and identities around the clock and act on threats.
HIPAA Security Rule
The HIPAA Security Rule is the federal regulation that sets the administrative, physical and technical safeguards required to protect electronic patient data.
Managed Security Service Provider (MSSP)
A managed security service provider (MSSP) is an outside firm that watches a business's systems for threats and responds to attacks around the clock.
Extended Detection and Response (XDR)
Extended detection and response (XDR) correlates signals from endpoints, email, identities and cloud apps into single incidents with a coordinated response.
Get the controls, not just the definition.
A NetSys engineer can tell you in fifteen minutes whether you have this covered, and what it would take if you do not. Month to month, no long-term contract.