Immutable backups

What is an immutable backup?

An immutable backup cannot be altered or deleted for a fixed period, even by your IT provider or someone using stolen administrator credentials. This protection is enforced by the backup platform itself, often using technologies such as Object Lock or Write Once, Read Many (WORM) storage. While terminology varies between vendors, the principle is the same: once written, the backup cannot be changed until the retention period expires.

Backup solutions that don't qualify

Many businesses assume they're protected when they aren't.

Three questions to ask your IT provider

Before completing your renewal, ask:

• Are our backups immutable, and how long is the retention period? Most insurers now expect at least 14 days, with 30 days increasingly considered best practice.
• If our Microsoft 365 Global Administrator or Domain Administrator account was compromised, could an attacker delete our backups? The answer should be no.
• Can you provide evidence that immutability is enabled? A screenshot or vendor documentation should confirm the setting is active.

What if the answer is no?

Answer honestly on your insurance application and use the renewal process as an opportunity to improve your backup strategy.

In many cases, immutability can be enabled on your existing backup platform without replacing the software. If your IT provider can't clearly explain how your backups are protected or answer the questions above, it's worth investigating before your next renewal. Whatever you do, don't tick Yes unless you're certain your backups meet the requirements. Cyber insurance applications form part of your policy, and inaccurate information could allow an insurer to reject or invalidate a future claim.

Paying a slightly higher premium is far less costly than discovering your policy won't pay out after a ransomware attack.