If ransomware hits, attackers often delete your backups first, then lock up everything else. That is why cyber insurance applications now ask, \u201cDo you maintain immutable, air gapped, or offline backups of your critical data?\u201d If backups can be changed or deleted with normal admin credentials, the real answer is no. That answer can affect your renewal, your premium, and your ability to collect on a claim.<\/p>\n
An immutable backup is a copy of your data that nobody can change or delete for a set amount of time. Not you. Not your IT provider. Not an attacker using stolen admin credentials. The storage system enforces the lock. Vendors may call it Object Lock, WORM, or immutable storage. Different names, same idea.<\/p>\n
CISA, the FBI, and the Internet Crime Complaint Center (IC3) document that ransomware actors frequently wipe backups first, then encrypt everything else. If a thief can use the same admin account you use every day to delete your backups, you have no clean way to recover.<\/p>\n
A NAS on your network or a drive that stays plugged in is reachable by ransomware. If attackers get domain admin, they can erase it. These devices can be useful for quick restores, but they are not immutable.<\/p>\n
Microsoft 365 has retention features, but a global admin, or anyone who steals that login, can purge data and retention holds. Under Microsoft\u2019s shared responsibility model, backing up your data is still your job.<\/p>\n
Many good backup tools offer immutability, but it is not always on by default. You have to enable it and verify it. Do not assume it is active.<\/p>\n
Immutability is actually turned on for the data you care about. The feature must be enabled, not just available in the product. Common vendors that support this include Veeam, Datto, Rubrik, Acronis, and S3 compatible storage with Object Lock.<\/p>\n
Backup credentials are isolated from your day to day admin accounts. The logins that control backups should be separate from Microsoft 365 and domain admin logins. If one set is stolen, attackers still cannot touch your backups.<\/p>\n
The retention window is long enough. Aim for at least 14 days. Thirty days is safer and often requested by carriers. Longer windows increase your odds of having a clean restore point.<\/p>\n
Restores are tested. Run a restore test at least once a year and record the date. Many insurers ask for it.<\/p>\n
Tell the truth on the application, then use the renewal to fix gaps.<\/p>\n
Start with your current platform. Ask your IT provider if immutability can be enabled where you already back up. Often it is a configuration change, not a new purchase.<\/p>\n
Watch for red flags. If your provider cannot clearly answer the three questions above, or will not provide proof, treat that as a priority issue to resolve before your next renewal.<\/p>\n
Do not check yes if it is not true. If a post incident investigation shows your backups were not immutable, the carrier can rescind the policy and claw back payouts. That mistake is costly for small businesses.<\/p>\n
From the Arena District to Dublin, Hilliard, Worthington, and New Albany, local businesses are regular targets. Immutable backups are now basic table stakes for cybersecurity and insurance readiness in Central Ohio. If you work with a Columbus IT company or MSP, ask for immutable, tested backups to be part of your standard service, not an optional add on.<\/p>\n
What does immutable backup mean?<\/strong><\/p>\n A backup that cannot be changed or deleted for a set time, even by administrators. The storage system blocks it.<\/p>\n Is Microsoft 365 retention a backup?<\/strong><\/p>\n No. A global admin can still purge data. You need separate, immutable backups.<\/p>\n How long should the immutability window be?<\/strong><\/p>\n At least 14 days. Thirty days is becoming standard. Some insurers ask for longer.<\/p>\n Can my IT provider just turn immutability on?<\/strong><\/p>\n Often yes, if your platform supports it. Ask for written confirmation or a screenshot.<\/p>\n What happens if I say yes on the form when I should not?<\/strong><\/p>\n The insurer can void the policy after a claim and claw back payouts. Misrepresentation is a common reason claims get denied.<\/p>\n <\/p>\n