What Immutable Backup Means on Your Cyber Insurance Form

Cyber insurance applications include a question that catches a lot of small business owners off guard:

Carriers added that question because ransomware operators worked out that the fastest way to force a payout is to wipe the backups first and encrypt everything else after. CISA, the FBI, and the Internet Crime Complaint Center have all documented this pattern as one of the most common moves in current ransomware playbooks.

A business whose backup copies can be deleted using the same admin credentials an attacker just stole has no recovery path other than paying the ransom.

This post covers what immutable backup means, three common setups that do not qualify, the questions to send your IT provider before you sign the form, and what to do if your honest answer is no — especially relevant for Pine Belt businesses renewing cyber policies in Mississippi.

(Pairs with our May guide on answering cyber insurance renewal questions without voiding your policy.)

Immutable backup, defined

An immutable backup is one that cannot be modified or deleted for a fixed period of time — including by you, by your IT provider, and by anyone using stolen admin credentials.

The stolen-credentials piece is what carriers care about. Most backup systems can be wiped by anyone with admin access. Immutability means the backup platform itself enforces the lock at the storage layer, and no credentials — however privileged — can override it during the retention window.

Vendors may call this object lock, write-once-read-many (WORM), or similar. Terminology varies; the underlying control is the same.

Three common backup setups that do not qualify

1. A NAS or external drive in your office

A network-attached storage device in your server room is reachable from your network by design. If ransomware spreads, it can reach the NAS. An attacker with domain admin credentials can wipe what’s on it. An external drive plugged in weekly and left connected has the same exposure.

These devices can play a role in a broader strategy. On their own, they do not satisfy the immutability question.

2. Microsoft 365 retention treated as a backup

Microsoft 365 includes retention features, and some businesses treat them as a backup. They are not a backup in the sense the form is asking about. An attacker with global admin access can delete data and purge retention holds.

Under Microsoft’s shared responsibility model, customers retain responsibility for backup and protection of their own data — separate from what Microsoft provides at the platform level.

If your only protection for Microsoft 365 data is what Microsoft provides natively, the honest answer to the immutability question is no.

3. A cloud backup with immutability switched off

This is the most common gap. Many reputable platforms include immutability as a feature — but it’s not always enabled by default. You may be paying for a solution that looks credible on paper while the immutability toggle sits off. You can’t tell from the invoice without checking.

Three questions to send your IT provider before you sign

Copy these into an email before you check the box:

1. “Are our backups immutable, and if so, how long is the immutability window?”
Most insurers want at least 14 days as a floor; 30 days is increasingly preferred. Attackers sometimes sit in a network for weeks before triggering ransomware — so yesterday’s backup may already be compromised.

2. “If our domain admin or Microsoft 365 global admin account were stolen tomorrow, could that account delete our backups?”
The correct answer is no. If the answer is yes — or “not sure” — your backups are not immutable in the way the form means.

3. “Can you send a screenshot or vendor documentation showing immutability is enabled on our account?”
Concrete evidence means the work was done. Verbal reassurance with nothing to show should be treated as a no until demonstrated.

What a qualifying setup looks like

For your backup to honestly satisfy the form, several things need to be true at once:

• Immutability is turned on — not merely available as a feature. Vendor names (Veeam, Datto, Rubrik, Acronis, S3 object lock, etc.) on an invoice are not enough.
• Backup credentials sit outside regular administrative accounts. If the same login that manages Microsoft 365 also controls backups, a compromised admin reaches both.
• Retention window is long enough. A 24-hour overwrite cycle doesn’t help if an attacker has been inside for a week. CISA’s Stop Ransomware guidance lists immutable, tested backups as a baseline; insurers increasingly align with that.
• Restores are tested. Most carriers now ask for the date of your last successful restore test — and they want to see one.

At West Computers, we deploy isolated cloud backup and disaster recovery with vaulted, immutable copies — and we test restores on a schedule. A backup you’ve never restored is just a hope on an insurance form.

What to do if your honest answer is no

Declare what you have on the form, and use the renewal as the reason to fix what isn’t there.

First: Ask whether immutability can be enabled on your existing platform. Often the capability is already there — a configuration change, not a new purchase. That conversation can usually be resolved in a few days.

If your provider can’t answer the three questions clearly, that response is itself important information. This area needs attention before your next renewal — even if other parts of IT are handled well.

One thing to avoid: do not check yes to dodge a premium hike. Cyber insurance applications function as warranty documents. If forensics after a claim find your backups didn’t match what you declared, the carrier can rescind the policy — treating coverage as if it never existed, with prior payouts under the same term potentially clawed back.

Checking no will likely cost something at renewal — premium or coverage terms. That’s a known, manageable cost. Take the hit on the application, and use the months until next renewal to close the gap.

Frequently asked questions

What does immutable backup mean in plain English?
A backup that nobody can change or delete for a set period — even with administrator credentials. The storage platform enforces the lock at the system level.

Is Microsoft 365’s built-in retention a backup?
No. Native retention can be bypassed by a global admin or anyone who steals one. Microsoft’s shared responsibility model places backup of your data on the customer.

How long should the immutability window be?
Most insurers and frameworks point to a minimum of 14 days. Thirty days is increasingly preferred; some carriers want longer.

Can my IT provider just turn immutability on?
Often yes — if your platform supports the feature and it hasn’t been enabled. Ask for written confirmation once it’s done.

What happens if I check yes on the form when I shouldn’t?
The carrier can rescind the policy after a claim, voiding coverage retroactively. Misrepresentation is one of the most common reasons cyber claims are denied.

Article adapted with permission from The Technology Press.