What immutable backup means on your cyber insurance form

Article Summary: An immutable backup is a copy of your data that nobody can change or delete during a set retention period. That includes administrators and attackers using stolen passwords. Cyber insurance carriers ask about immutable backups because ransomware gangs routinely destroy backups before they encrypt everything else. A backup on your network, protected only by regular admin credentials, doesn’t count.

Cyber insurance applications include a question that catches many small business owners off guard: “Do you maintain immutable, air-gapped, or offline backups of your critical business data?”

Carriers added this question for a simple reason. Ransomware gangs learned that the fastest way to force a payout is to wipe the backups first and then encrypt everything else. CISA and the FBI have both documented this tactic as a standard move in today’s ransomware attacks. If an attacker can delete your backups with the same admin password they just stole, paying the ransom becomes your only way back.

At Pacific Edge Technology, this is one of the first questions we help businesses across Richland, Kennewick, and Pasco answer honestly before a renewal. This post explains what an immutable backup is and covers three common setups that don’t qualify. It also gives you questions to ask your IT provider and steps to take if your honest answer is no.

What is an immutable backup?

An immutable backup can’t be changed or deleted for a set period of time. That rule applies to you, your IT provider, and anyone using stolen admin credentials.

The stolen credentials part is what carriers care about most. In most backup systems, anyone with admin access can wipe the backups. With immutability, the backup platform itself enforces the lock at the storage level. No password, however powerful, can override it during the retention window.

Vendors use different names for this feature. You may see object lock, write-once-read-many, or WORM storage. The terms vary, but the protection works the same way.

Three common backup setups that don’t qualify

Many business owners assume these three setups count as immutable backup. They don’t.

A NAS or external drive in your office

A network-attached storage (NAS) device in your server room connects to your network by design. If ransomware spreads through your systems, it can reach the NAS. An attacker with admin credentials can also wipe it. An external drive that someone plugs in once a week and then leaves connected carries the same risk.

These devices can play a role in a broader backup plan. On their own, they don’t meet the immutability requirement.

Relying on Microsoft 365 retention

Microsoft 365 includes data retention features, and some businesses treat them as their backup. They aren’t a backup in the sense the form means. In most setups, an attacker with global admin access can change retention settings and delete your data.

Microsoft is clear about this. Under its shared responsibility model, you’re responsible for protecting and backing up your own data. Microsoft handles the platform, not your backups.

If your only protection for Microsoft 365 data is what Microsoft provides natively, your honest answer to the immutability question is no.

A cloud backup with immutability turned off

This is the most common gap we see. Many reputable backup platforms offer immutability, but they don’t always turn it on by default. Someone has to enable it. Your business may pay for a backup service that looks solid on paper while the immutability setting sits switched off. You can’t tell without checking.

Three questions to ask your IT provider before you sign

Copy these into an email and send them before you check the box.

Question 1: “Are our backups immutable, and if so, how long is the immutability window?”

Carrier expectations have tightened over the past two years. Most insurers want at least 14 days, and many now prefer 30. Attackers sometimes hide in a network for weeks before launching ransomware. That means yesterday’s backup may already contain their foothold. Your window needs to reach back to clean restore points from before the attacker arrived.

Question 2: “If someone stole our domain admin or Microsoft 365 global admin account tomorrow, could they delete our backups?”

The right answer is no. If your provider says yes, or isn’t sure, your backups don’t meet the standard the form describes.

Question 3: “Can you send me a screenshot or vendor documentation showing immutability is turned on for our account?”

A provider who can send proof has done the work. If you only get verbal reassurance, treat the answer as no until they can show you otherwise. Pacific Edge Technology clients working through a renewal can get this documentation directly from us.

What a qualifying immutable backup setup looks like

For your backup to honestly satisfy the question, several things need to be true at once.

Immutability is turned on. Having the feature available isn’t enough. Major vendors like Veeam, Datto, Rubrik, and Acronis offer immutability, as do most cloud storage providers that support S3 object lock. A well-known vendor name on your invoice doesn’t answer the question by itself. Someone has to turn the setting on and configure it properly.

Backup credentials stay separate. If the same login manages both Microsoft 365 and your backup platform, one stolen account can reach both. A qualifying setup keeps backup credentials separate from your everyday admin accounts.

The retention window is long enough. A backup that overwrites itself every 24 hours won’t help if an attacker has been inside for a week. CISA’s #StopRansomware Guide lists immutable, tested backups as a baseline control. Most insurers now follow the same standard.

Someone has tested restores. You can’t count on a backup nobody has restored in the past 12 months. Most carriers now ask for the date of your last successful restore test.

What to do if your honest answer is no

Answer the form truthfully. Then use the renewal as your reason to fix the gap.

Start by asking your IT provider whether your current platform supports immutability. Often it does, and turning it on is a settings change, not a new purchase. In that case, you can usually fix the problem within a few days.

What if your provider doesn’t understand the question or can’t clearly answer the three questions above? That tells you something important. Your backups need attention before your next renewal, even if the rest of your IT runs smoothly.

Don’t check yes to avoid a premium increase

Your policy relies on the answers you give. After a claim, the carrier will often investigate. If your backups don’t match what you declared, the carrier may be able to rescind the policy. In that case, it treats your coverage as if it never existed and can claw back earlier payouts. Rules vary by state and policy, so ask your broker how this applies to you.

Answering no will likely cost you something at renewal, either in premium or coverage terms. That cost is known and manageable. Accept it, then use the months before your next renewal to close the gap.

If you’re a Tri-Cities business and want a clear answer, get in touch with Pacific Edge Technology. We’ll review your current backup setup, tell you exactly where it stands, and help you get to a true immutable backup.

Immutable Backup FAQs

What does immutable backup mean in plain English?

It’s a backup nobody can change or delete for a set period, even with administrator credentials. The storage platform enforces the lock itself, so no user permissions can override it.

Is Microsoft 365’s built-in retention a backup?

No. In most setups, a global admin, or anyone who steals that account, can change retention settings. Microsoft’s shared responsibility model makes backing up your data your job, not Microsoft’s.

How long should the immutability window be?

Most insurers and security frameworks point to at least 14 days. Many now prefer 30, and some carriers want longer. A longer window gives you a better chance of a clean recovery if an attacker hid in your systems for a while.

Can my IT provider just turn immutability on?

Often, yes. If your backup platform supports it, turning it on is a settings change rather than a new purchase. Ask for written confirmation once it’s done.

What happens if I check yes on the form when I shouldn’t?

After a claim, the carrier may be able to rescind the policy, which cancels coverage retroactively. It may also claw back earlier payouts under the same policy. Misrepresentation is a serious risk, so answer honestly and talk with your broker about any gaps.

Article used with permission from The Technology Press.