An immutable backup keeps a restore point protected against modification or deletion for a defined retention period. It can help preserve recovery data after ransomware, accidental deletion or compromise of a backup account.
Simple definition
Immutability locks backed-up data until a retention deadline. It complements separate copies, protected administration and recovery testing. An immutable restore point alone does not prove that an application can be recovered.
Technical definition
Protection may use WORM storage, Object Lock or a hardened backup repository. Establish which storage layer enforces the restriction, which files or object versions are protected, and which identities can change retention settings.
Retention modes provide different guarantees. In Amazon S3 Object Lock, Governance mode allows specially authorized users to bypass retention. Compliance mode prevents users, including the root user, from deleting a protected object version or shortening its retention before expiry. The exact boundary and exceptions depend on the documented service behavior.
What is it used for?
The aim is to retain usable recovery points when production data or ordinary backup administration is affected. Also review shared dependencies such as privileged accounts, the backup server, storage access, encryption keys and the recovery catalogue.
Concrete example
A repository locks restore points for 14 days. Ordinary deletion attempts are rejected during that period. Data must still be readable and usable by the supported recovery tools.
Practical example: retention and capacity
A 30-day policy protects relevant points for longer, while requiring more capacity. Choose retention using incident-detection delays and recovery objectives. Account for new backup data that must be written while older locked points cannot yet be purged.
How to check an immutable backup
- Identify the actual WORM, Object Lock or hardened-repository mechanism.
- Check effective retention, privileged permissions and policy changes.
- Monitor free capacity, data growth and the ability to continue backup jobs.
- Check that recovery keys, catalogues and required access remain available without the original backup server.
Common issues: retention and capacity
A short retention window may expire before an incident is detected. Insufficient storage can stop new backups while protected points cannot be removed. Identify any permissions that can bypass a governance mode and protect those accounts.
Common problems: isolation and shared control
Immutable does not mean offline or off-site. Copies controlled through one account or management plane can still share a failure point. Combine retention enforcement with administrative separation, appropriate isolation and a tested recovery process.
How to validate recovery
Regularly restore files and a representative system from a still-protected point in a test environment. Check data integrity, application behavior and recovery time. Also test loss of the original backup server. Monitor failed jobs, deletion attempts, retention changes and approaching capacity limits.
FAQ — Immutable backup
Is an immutable backup impossible to delete forever?
No. Protection depends on the technology, retention mode and period. Review privileged permissions and the conditions documented by the provider.
Is it the same as an air gap?
No. An air gap isolates copies. Immutability restricts modification and deletion. An immutable copy can remain online; an offline copy can provide complementary protection.
Which test is essential?
A real restore from a protected point, including the keys, accounts and dependencies needed when the usual backup infrastructure is unavailable.