Somewhere on your cyber insurance renewal application there is a question about immutable backups. It is usually a checkbox, it usually gets answered by whoever is filling in the form, and it is one of the questions most likely to be answered wrong.
That matters, because the application is a warranty. After an incident, forensic investigators will establish what was actually in place, and a control you attested to but did not have is grounds to deny the claim.
What immutable actually means
An immutable backup is one that cannot be modified or deleted for a defined retention period — by anyone, including an administrator holding valid credentials. Not “protected by permissions.” Not “only the IT provider can delete it.” Cannot be deleted, full stop, until the retention window expires.
The technical mechanism is usually write-once-read-many storage, or an object lock at the storage layer that the backup software itself has no authority to override.
The distinction matters because of how ransomware actually works. Attackers spend days or weeks in a network before triggering encryption, and during that time their priority is finding and destroying the backups. They have your administrator credentials by then. Anything those credentials can delete, they will delete. Immutability is specifically the control that survives an attacker with full administrative access.
What does not count
Several arrangements get described as immutable and are not.
Cloud backup is not automatically immutable. Backing up to a cloud provider means your data is offsite, which is valuable, but if your backup console can delete those files then so can an attacker in your backup console.
Snapshots are usually not immutable. Storage or hypervisor snapshots are typically deletable by an administrator, and ransomware routinely deletes Windows shadow copies as its first action.
Versioning is not immutability. Object storage versioning keeps old copies, but unless object lock is explicitly configured, those versions can be purged.
A separate account with a different password is not immutability. It is better than nothing — it raises the effort required — but it is a permission boundary, not a technical prohibition.
How to find out what you actually have
Ask your IT provider or backup vendor three specific questions, and get the answers in writing.
First: if someone had our backup administrator credentials right now, could they delete our backups? If the answer is yes, you do not have immutable backups.
Second: what is the immutability retention period? This needs to be longer than your likely detection window. Seven days is not enough if an attacker sat in your network for a month. Thirty days is a reasonable floor for most small businesses.
Third: which specific backup sets are immutable? It is common for the cloud copy to be locked while the local copy — the one you would restore from fastest — is not.
The related questions on the same form
Immutability rarely appears alone. The backup section of a modern application typically also asks whether backups are stored offline or in a separate security domain, whether restores are tested and how often, whether backup systems use credentials separate from your production directory, and what your recovery time objective is.
That last one is worth taking seriously as a business question rather than a form question. Many businesses can restore, but not quickly enough to matter. If the honest answer is that a full restore would take a week, the insurer’s business interruption exposure — and yours — is very different from what a checkbox suggests.
If the answer today is no
Do not check the box. Instead, find out what it would take to make it true, because for most small businesses this is not an expensive change. Most current backup platforms support immutability natively against cloud object storage with object lock, and enabling it is largely a configuration exercise.
Then re-answer the question accurately. An honest answer may cost you a slightly higher premium. An inaccurate one can cost you the entire claim, at the worst possible moment.
The underlying point
Insurers ask about immutable backups because their claims data shows it is one of the strongest predictors of whether a ransomware incident becomes a catastrophe. That is a useful signal independent of the insurance: the question is on the form because the control works.
If you have a renewal coming up and want the technical questions answered accurately, send us the application. We will tell you plainly what is true in your environment and what it would take to make the rest true.