Guide · Backup Resilience

Immutable Backups Explained: The 2026 Standard for Ransomware Resilience

An immutable backup is a copy of your data that cannot be changed or deleted for a set time, even by an administrator. That is what makes it valuable against ransomware, which often goes after backups first. This guide explains how immutability works, how it differs from offline copies, the 3-2-1-1-0 rule, and how a small business can use it.

Last updated: 25 October 2026By Ktech Media Solutions

Data Recovery Backup Ransomware Explainer

5backup rules explained

16FAQs answered

10min read

Immutable backup

Backup writtenWaiting✓ Done

Lock applied (WORM)Waiting✓ Locked

Ransomware tries to deleteDeleting✓ Blocked

Sealed backup vault with a lock icon that ransomware cannot alter, beside normal backups being encrypted

Quick answer

Short answer: An immutable backup can't be altered or deleted until its retention period ends.
Why it matters: Veeam found attackers targeted backup repositories in 93% of attacks it examined.
How it works: Usually write-once-read-many (WORM) storage, such as Amazon S3 Object Lock or immutable disk repositories.
Not a full strategy: You still need tested restores, a clean environment and sensible retention.
Modern rule: 3-2-1-1-0: three copies, two media, one off-site, one immutable or air-gapped, zero recovery errors.
Caution: Compliance-style locks can't be undone, so set retention carefully.

What immutable means

Definition: Once written, the backup can't be modified or deleted until its retention period ends.
WORM: Write once, read many. You can read the data but not change it.
Even for admins: In strict modes, even a privileged account can't shorten or remove the lock.
What it protects against: Ransomware encrypting backups, malicious deletion and accidental removal.
What it doesn't protect against: Bad data written into the backup, or a failed restore.

How immutability works

Diagram of immutable backup flow: production data written to a locked repository where changes and deletes are blocked until retention ends

Object storage lock: Amazon S3 Object Lock uses a write-once-read-many model to prevent objects being deleted or overwritten for a fixed period or indefinitely.
Versioning required: On S3, Object Lock works only in buckets with versioning enabled, and locks apply to a specific version.
Retention modes: Governance mode blocks most users but lets authorised users override. Compliance mode blocks everyone, including the root user.
Legal hold: A separate lock with no expiry that stays until explicitly removed.
Other implementations: Immutable disk repositories, tape and other cloud providers have their own versions.
Read the product docs: Behaviour differs by vendor, so check yours.

Immutable vs offline vs air-gapped vs ordinary backup

Type	Reachable by attackers?	Can be deleted?	Main weakness
Ordinary backup on the network	Often yes	Yes, with credentials	Encrypted or deleted with everything else
Offline copy (disconnected media)	Only when connected	Physically, by someone	Easy to forget; slow to restore
Air-gapped copy	No network path	Not remotely	Needs process to keep current
Immutable copy	Reachable, but locked	Not until retention ends	Misconfiguration or long lock settings

Not either/or: Many strategies combine an immutable copy with an offline copy.
Immutable isn't invisible: An attacker can still see it; they just can't change it.

The 3-2-1 and 3-2-1-1-0 rules

The 3-2-1-1-0 backup rule: three copies, two media types, one off-site, one immutable, zero errors

3: Keep three copies of your data, the original plus two backups.
2: Store them on two different types of media.
1: Keep one copy off-site.
1 (added): One copy is immutable or air-gapped.
0 (added): Zero recovery errors, meaning you verify the backups actually restore.
Source: Veeam describes 3-2-1-1-0 in these terms. It's a vendor's framing, but the logic is widely used.
RAID doesn't count: RAID is not a backup.

Where immutable backups fit for a small business

Start with what matters: Accounts, customer records, shared files, email and key servers.
Options: Backup software with an immutable repository, cloud storage with object lock, or a managed backup service.
Keep it separate: Use different credentials and, ideally, a different account from your main admin.
Use multi-factor authentication: On the backup console and cloud account.
Set retention: Long enough to cover slow-detected attacks, short enough to manage cost.
Keep one offline copy: Particularly for the data you can't lose.
Document restores: Who does what, in what order. See RTO vs RPO.

Mistakes to avoid

Assuming "cloud" means immutable: Ordinary cloud storage can be deleted. Immutability must be switched on.
Setting lock periods too long: On compliance modes you can't shorten them, and AWS notes the only way to delete early is to delete the account.
Using the same admin account: If an attacker takes it, they may remove your protection.
Never testing restores: Immutability keeps the copy, not the ability to restore.
Backing up infected data: Immutable copies preserve whatever you wrote.
Forgetting the keys and settings: Document where backup encryption keys and configuration live.

Trade-offs and limits of immutable backups

Benefits and limits of immutable backups shown side by side

Higher storage cost: Locked data can't be deleted early, so you pay to keep it.
Doesn't fix bad data: If a corrupted or infected file is backed up and locked, it stays locked.
Doesn't cover physical damage on its own: Keep copies in more than one place.
Retention is a commitment: Choose lengths with care, because you can't shorten a compliance lock.
Access still matters: Protect the accounts that manage backups with strong authentication.
It isn't a substitute for testing: A locked copy you can't restore is still a failed backup.

How to test an immutable backup

Restore a file: Confirm you can retrieve a single item.
Restore a system: Try recovering a server or critical application into a clean environment.
Try a safe delete test: On a test copy, confirm deletes and changes are blocked.
Time it: Record how long the restore took.
Review access: Check who can change retention and settings.
Repeat on a schedule: Test regularly and after any change.

Clean restore points: scan before you restore

Backup restore point scanned in an isolated area before returning to production

Malware can sit quietly: Some attacks stay dormant for a long time, so a locked backup can contain the problem.
Keep several restore points: If the newest is infected, you need an older clean one.
Scan in isolation: Restore into a separate environment and check before going live.
Then reconnect: Only after systems pass your checks.

India: what to watch for

Small-office habits: Many offices keep a single external drive or NAS with no off-site copy.
Data location: Consider where cloud backups are stored and whether your data rules limit location.
Reporting duties: CERT-In directions and DPDP rules may apply to incidents affecting personal data. Ask your adviser.
Local help: Our backup and disaster recovery service covers planning for Mumbai businesses.

Limits and honest caveats

Vendor framing: 3-2-1-1-0 comes from Veeam, and Veeam sells backup software. Veeam's 93% finding is from a 2023 survey about 2022 attacks.
AWS specifics: Our technical detail uses Amazon S3 as an example. Other products differ.
Immutable is not impenetrable: A compromised cloud account or misconfiguration can still cause loss.
No product recommendation: We don't say which product is best here.

How our services help

Backup and disaster recovery: Backup design with immutable and offline copies.
Ransomware data recovery: If backups were hit.
Business data recovery: For servers and company data.

Frequently asked questions

Still have a question? Ask our team

It is a backup that cannot be changed or deleted until its retention period ends. It usually uses write-once-read-many storage. That stops ransomware or a malicious user from altering or removing it.

They protect the backup copy from being altered or deleted, which is the main weakness ransomware exploits. They don't protect you if the backup was infected before it was written or if you can't restore. Test restores.

Immutable copies are reachable but locked against change. Air-gapped copies have no network path at all. Many strategies use both.

Three copies, on two media types, with one off-site, one immutable or air-gapped, and zero errors on restore tests. It extends the older 3-2-1 rule to handle ransomware.

It is an Amazon S3 feature that prevents objects being deleted or overwritten for a set period. It needs versioning enabled and offers governance and compliance retention modes.

Governance mode blocks most users but lets authorised users override it. Compliance mode blocks everyone, including the root user, and can't be shortened.

Some NAS and backup products offer snapshot locking or immutable repositories. Check what yours supports, and don't rely on settings you haven't tested.

Long enough to cover how long an attack might go unnoticed, but not so long that cost or lock-in becomes a problem. Many businesses choose weeks to months. Decide with your adviser.

No. Immutability protects the copy but doesn't prove you can restore. Test restores regularly.

No. RAID is not a backup and doesn't protect against ransomware or deletion.

Add one off-site, locked or offline copy of your most important data and test restoring it. Build from there. We can't quote costs here.

Not through normal controls while the lock is active. Risks include a compromised cloud account, weak settings or deleting the whole account, so protect those with strong access controls.

Yes. Locked data costs storage until the retention ends, it doesn't correct data that was already bad when it was backed up, and it doesn't protect against physical loss on its own.

It can, if the malware was already present when the backup was taken. Keep several restore points and scan restored systems in isolation before reconnecting.

Write once, read many. Data is written once and can then be read but not changed or deleted until its retention period ends.

No. Versioning keeps older copies of a file but they can usually still be deleted. AWS S3 Object Lock uses versioned objects and then locks them for a retention period.

Go deeper: the guides in this series

Sources6 references

Ready to find out where you stand?

If you want a backup design that survives ransomware, talk to our team. We'll help you plan copies, retention and restore tests.

Contact our backup and recovery team