What Is an Immutable Backup?
A backup copy that cannot be altered or deleted for a set period, even by an admin.
An immutable backup is a backup copy that cannot be modified, encrypted or deleted for a defined retention period, even by someone with administrator credentials. It exists specifically because ransomware attackers go after backups first. If the copy cannot be touched, you can always recover without paying.
Why it became necessary
Once an attacker has admin access, ordinary backups are just more files to encrypt or delete. Modern ransomware playbooks include locating the backup server and cloud console and wiping them before triggering encryption. Immutability removes that option.
How it works
- Object lock in cloud storage. The backup platform writes to storage that enforces write-once-read-many for the retention period.
- Hardened backup repositories. On-premises appliances that accept new backups but refuse deletion or modification until retention expires.
- Separate credentials. The backup system does not trust your domain administrator account, so a compromised admin cannot reach it.
What it does not replace
Immutability protects one copy. You still need the rest of the 3-2-1 backup rule: multiple copies, off-site storage, monitoring and regular restore tests. It also does not stop the attack itself; see how to prevent ransomware.
Insurance and compliance
Cyber insurance questionnaires now routinely ask whether backups are immutable, offline or air-gapped, encrypted and tested. A "no" on immutability can affect eligibility or premium. See the cyber insurance requirements checklist.
Questions to ask your provider
Which copy is immutable, and for how long? Can the backup system be reached with our domain admin credentials? When was the last restore test, and what did it restore?
Mentis Group's backup standard for Fully Managed IT clients includes immutability, encryption and geographic redundancy, with backups continuously monitored, tested and verified, and it is one of the core protections in our ransomware prevention approach.
Have a question about your own environment? Schedule a consultation with Mentis Group or call (866) 901-7808.