Many business owners are surprised when they reach the cyber insurance section that asks:
“Do you maintain immutable, air-gapped, or offline backups of your critical business data?”
At first glance, the question seems straightforward. However, many organizations discover they do not know the answer.
Unfortunately, insurance carriers are asking this question for a reason.
Modern ransomware attacks frequently target backup systems before encrypting business data. As a result, organizations without protected backups often have no choice but to pay the ransom or permanently lose critical information.
According to guidance from the Cybersecurity and Infrastructure Security Agency (CISA), attackers commonly attempt to delete or disable backups before launching ransomware.
Therefore, cyber insurance companies increasingly require businesses to demonstrate that their backups cannot be altered or deleted by attackers.
If you’re unsure whether your current backup solution qualifies, this guide will help you understand what immutable backups are, what does not qualify, and how to verify your protection before signing your next cyber insurance application.
What Is an Immutable Backup?
An immutable backup is a backup that cannot be changed, deleted, or overwritten for a specific period of time.
Importantly, this protection applies even if an attacker gains administrative access to your systems.
In other words, neither:
- Employees
- IT administrators
- Managed Service Providers (MSPs)
- Cybercriminals
can modify or delete the backup during the defined retention period.
This protection is typically enforced at the storage level using technologies such as:
- Object Lock
- WORM (Write Once Read Many)
- Immutable Storage
- Retention Lock Policies
Although terminology varies by vendor, the objective remains the same.
The backup remains protected regardless of who has administrative access.
Because ransomware attackers often steal privileged credentials before launching an attack, immutable storage provides a critical last line of defense.
To learn more about ransomware protection, visit our Cybersecurity Services Houston page.
Three Common Backup Solutions That Do NOT Qualify
Many businesses believe they have immutable backups when they actually do not.
Let’s review the most common misconceptions.
1. A NAS Device or External Hard Drive
Many organizations store backups on:
- NAS devices
- External hard drives
- Local storage appliances
Although these solutions provide redundancy, they do not provide immutability.
Because these devices remain connected to the network, ransomware can often reach them.
Furthermore, attackers who obtain administrative credentials may be able to delete the backup data entirely.
Therefore, a NAS or external drive alone generally does not satisfy cyber insurance requirements.
2. Microsoft 365 Retention Policies
Many businesses assume Microsoft automatically backs up everything inside Microsoft 365.
Unfortunately, that assumption is incorrect.
While Microsoft provides retention and recovery features, those features are not considered true backups for cyber insurance purposes.
Under Microsoft’s Shared Responsibility Model, customers remain responsible for protecting their own data.
Consequently, an attacker who gains Global Administrator access may still be able to delete data or remove retention controls.
For organizations relying heavily on Microsoft 365, we recommend reviewing our Microsoft 365 Consulting Services.
You can also review Microsoft’s official guidance here:
Microsoft Shared Responsibility Model
3. Cloud Backups Without Immutability Enabled
This is one of the most common issues we discover during cybersecurity assessments.
Many backup platforms support immutable storage. However, the feature is often disabled by default.
As a result, businesses assume they are protected when they are not.
Simply having a backup platform is not enough.
The immutability feature must be:
- Enabled
- Properly configured
- Tested regularly
- Protected by separate credentials
Without those controls, your backup may still be vulnerable to ransomware attacks.
Three Questions to Ask Your IT Provider Before Signing the Form
Before checking “Yes” on a cyber insurance application, ask your IT provider these three questions.
Question #1: Are Our Backups Immutable?
Ask:
“Are our backups immutable, and how long is the retention window?”
Many insurers now expect at least:
- 14 days minimum
- 30 days preferred
- Longer retention for larger organizations
Because ransomware attackers may remain undetected for weeks, longer retention windows provide safer recovery options.
Question #2: Can Stolen Admin Credentials Delete Our Backups?
Ask:
“If our Microsoft 365 Global Admin account or Domain Admin account were compromised tomorrow, could an attacker delete our backups?”
The correct answer should be:
No.
If the answer is yes, your backups likely do not meet the intent of the insurance question.
Question #3: Can You Prove Immutability Is Enabled?
Ask for:
- Screenshots
- Vendor documentation
- Configuration reports
- Backup platform settings
A reputable provider should be able to provide documentation quickly.
If they cannot demonstrate immutability, assume it is not configured until proven otherwise.
What Does a Cyber Insurance-Compliant Backup Strategy Look Like?
A qualifying backup strategy includes several important elements.
Immutable Storage Enabled
First, the platform must have immutability actively configured.
Many leading platforms support immutable storage, including:
- Veeam
- Datto
- Acronis
- Rubrik
- Microsoft Azure
- Amazon S3 Object Lock
However, purchasing one of these products does not automatically guarantee compliance.
The configuration matters.
Isolated Backup Credentials
Next, backup administration should be separated from everyday business accounts.
For example, your Microsoft 365 Global Administrator account should not also control your backup platform.
Instead, organizations should use:
- Dedicated backup administrator accounts
- Separate authentication controls
- Multi-Factor Authentication (MFA)
This separation significantly reduces risk.
Tested Recovery Procedures
Finally, backups must be tested.
A backup that has never been restored cannot be trusted during a disaster.
Many cyber insurance carriers now ask:
“When was your last successful restore test?”
Consequently, organizations should conduct periodic recovery testing and document the results.
To strengthen your disaster recovery posture, review our Managed IT Services Houston solutions.
What If Your Answer Is No?
Many businesses discover during renewal that they do not currently meet the requirement.
If that happens, be honest on the application.
Although a “No” answer may affect premiums, misrepresenting your environment can be far more costly.
Cyber insurance applications often function as warranty statements.
Therefore, if a post-breach investigation determines that your backups were not actually immutable, an insurance carrier may:
- Deny the claim
- Void the policy
- Rescind coverage
- Recover previous payouts
As a result, inaccurate responses can create substantial financial exposure.
Instead, use the renewal process as an opportunity to improve your security posture.
In many cases, enabling immutability is simply a configuration change rather than a major technology investment.
Why Immutable Backups Matter More Than Ever
Ransomware attacks continue to evolve.
Today, attackers focus on eliminating recovery options before encrypting systems.
Consequently, organizations can no longer assume traditional backups are enough.
Immutable backups provide a critical layer of protection because they prevent attackers from deleting the data needed for recovery.
For Houston businesses, this capability is increasingly becoming both a cybersecurity requirement and a cyber insurance requirement.
Schedule a Backup & Disaster Recovery Assessment
Not sure whether your backups meet cyber insurance requirements?
Graphene Technologies helps Houston businesses evaluate backup systems, disaster recovery plans, ransomware defenses, and cyber insurance readiness.
Our services include:
- Backup & Disaster Recovery Assessments
- Microsoft 365 Backup Solutions
- Ransomware Protection Reviews
- Cybersecurity Risk Assessments
- Cloud Backup Design
- Business Continuity Planning
- Managed IT Services
Learn more:
- Managed IT Services Houston
- Cybersecurity Services Houston
- Contact Graphene Technologies
Protect your data. Strengthen your cyber insurance position. Recover faster when incidents occur.