Immutable backup for cyber insurance means your backup copies can’t be changed or erased for a set time—by anyone, even with stolen admin logins—so you can restore after ransomware without paying a ransom.
Many renewal forms now include a question that surprises small business owners: do you keep backup copies that are immutable, air‑gapped, or offline? Insurers added it because modern ransomware groups often try to destroy backups first, then lock everything else to force a payout—an approach documented by federal guidance from CISA’s #StopRansomware Guide and the FBI Internet Crime Complaint Center. We see this come up often for offices around Panama City and across Bay County.
Below we explain what counts as immutable, common setups that don’t, the exact questions to send your IT team before you check the box, and what to do if your current answer is no.
What “Immutable” Really Means
An immutable backup is locked so that no one can delete or change it until the retention period ends—not you, not your IT provider, and not an attacker using administrator credentials.
The key point for carriers is credential theft. Many backup tools let anyone with admin rights wipe copies. With immutability, the storage system itself enforces a write-once rule that cannot be bypassed during the lock window. Vendors may call this object lock, write‑once‑read‑many, or WORM storage. Different names, same safeguard.
Setups People Assume Qualify (But Don’t)
A NAS or USB drive sitting in the office
Network storage in your server room is reachable from your network by design. If ransomware spreads, it can reach that device, and someone with domain‑level access can delete the backups on it. An external drive left plugged in all week has the same risk.
These devices can still be useful inside a broader strategy, but on their own they don’t meet the immutability requirement.
Treating Microsoft 365 retention as a backup
Microsoft 365 includes data retention features, but that isn’t the type of backup insurers are asking about. A global admin—or someone who steals that role—can remove data and clear retention holds. Per Microsoft’s shared responsibility model, customers are responsible for backing up their own data beyond what the platform provides.
If you rely only on Microsoft’s native features, the truthful answer to the immutability question is no.
A cloud backup that has the lock turned off
This is the most common miss. Plenty of reputable backup platforms offer immutability, but the setting isn’t always enabled by default. You might be paying for a solid solution while the immutability toggle is still off. You won’t know without checking.
Ask Your IT Provider These Three Things Before You Check the Box
Are our backups immutable, and what is the lock period? In the last couple of years, insurers have tightened expectations. Many look for at least 14 days, and 30 days is increasingly the preferred minimum. Attackers may lurk in a network for weeks before they strike, so you need restore points from before they arrived.
If our domain admin or Microsoft 365 global admin account were stolen tomorrow, could that access delete our backups? The right answer is no. If the answer is yes—or even “not sure”—your setup isn’t immutable in the way the form intends.
Can you show proof that immutability is enabled? Ask for a screenshot or vendor documentation tied to your account. Written evidence means the work is actually done. Verbal assurances without artifacts should be treated as a no until proven otherwise.
What a Passing Setup Looks Like
Immutability is enabled, not just available. Major vendors—Veeam, Datto, Rubrik, Acronis—and most S3‑compatible storage with object lock can do this. A vendor name on the invoice isn’t enough; the feature must be turned on, scoped correctly, and protected by credentials that aren’t shared with other systems.
Backup credentials are isolated. Your backup platform should use accounts that are separate from everyday admin logins. If the same identity can manage Microsoft 365 and the backup system, a single compromise can reach both.
The retention window is long enough. A 24‑hour rolling backup won’t help if an intruder has been present for a week. CISA’s #StopRansomware Guide calls immutable, tested backups a baseline control, and most carriers align with that view.
Restores are tested. If nobody has performed a restore in the past 12 months, don’t count on it during a crisis. Many carriers now ask for the date of your last successful restore test.
If Your Honest Answer Is No
State what you have on the form, then use the renewal as the trigger to close the gap.
First, ask your IT provider whether immutability can be switched on in your current platform. In many cases the feature already exists and only needs configuration, not a new product. If it’s supported but disabled, this is usually fixable within days.
If your provider isn’t familiar with the setting or can’t answer the three questions above, that tells you the issue needs attention well before the next renewal.
One thing to avoid: don’t mark yes just to dodge a premium increase. These applications function like warranty statements. If a post‑incident review finds your backups didn’t match what you certified, the carrier can rescind the policy and claw back payouts. That’s one of the costliest mistakes a small business can make on a cyber form.
Checking no may raise costs or tighten terms at renewal, but it’s a known, manageable outcome. Take the short‑term hit and use the months ahead to get compliant.
Frequently Asked Questions
In plain English, what is an immutable backup?
A backup copy that no one can change or delete for a fixed time. The storage platform enforces the lock, so even administrator rights can’t override it.
Does Microsoft 365’s built‑in retention count as backup?
No. A global admin—or someone who steals that role—can bypass it. Under Microsoft’s shared responsibility model, protecting and backing up your data is on the customer.
How long should we set the immutability window?
Most insurers and security frameworks look for at least 14 days. Thirty days is becoming a common minimum, and some carriers ask for more. A longer window improves your odds of restoring clean data if an attacker lingered.
Can my IT provider just enable immutability?
Often, yes. If your platform supports it and it’s off, turning it on is usually a configuration change. Ask for written confirmation once it’s enabled.
What if I say yes on the form when I shouldn’t?
The insurer can void the policy after a claim and recover prior payouts. Misrepresentation is a frequent reason for denied cyber claims.
Sources and further reading
- CISA #StopRansomware Guide — Federal ransomware guidance, including recommendations on immutable and tested backups.
- Microsoft shared responsibility model — What Microsoft secures versus what remains the customer’s job, including backup.
- FBI Internet Crime Complaint Center: Ransomware — Current FBI guidance and recommended controls.
If you’re unsure where your backups stand, ask your IT team to walk you through the settings—or get in touch with Flux Labs and we’ll help you sort it out before your next renewal.
—
