Immutable Backup
Pronunciation: ih-MYOO-tuh-bul BAK-up
Also known as: Write-once backup, Tamper-resistant backup
Definition
An immutable backup is a backup copy that cannot be altered or deleted during a defined retention period, including by ordinary administrators or compromised production credentials. It differs from an offline backup because immutability describes resistance to modification, while offline or air-gapped storage describes connectivity; a resilient design may use both properties.
Overview
Meaning and scope
An immutable backup is a backup copy that cannot be altered or deleted during a defined retention period, including by ordinary administrators or compromised production credentials. It differs from an offline backup because immutability describes resistance to modification, while offline or air-gapped storage describes connectivity; a resilient design may use both properties.
Mechanism and operation
Operational implementation should separate backup identities, enforce write-once retention, isolate management paths, encrypt copies, test restoration, monitor deletion attempts, maintain multiple generations, and protect keys and catalogs. The principal failure modes include misconfigured retention, shared credentials, untested restores, corrupted source data, compromised backup software, expired copies, and backups that omit critical dependencies. Useful measures include successful restore rate, immutable-copy coverage, backup age, deletion attempts, recovery time, and percentage of critical services with tested copies. Operationally, teams should separate backup identities, enforce write-once retention, isolate management paths, and encrypt copies.
Practical payment example
A ransomware attack encrypts the live settlement database. Operations recovers from a protected backup that ordinary compromised credentials cannot overwrite, then verifies integrity before replaying later events.
Operational checks
Verify that immutability controls really prevent administrators with compromised credentials from deleting or changing protected copies during the retention period. Store backup keys and control-plane permissions separately. Restoration drills should check file integrity, database consistency and event replay so unchanged backup bytes produce a trustworthy financial ledger.
Distinctions and limits
Key risks include misconfigured retention, shared credentials, untested restores, and corrupted source data. Review of Immutable Backup should determine whether safeguards addressing backup copy that cannot be altered, deleted during a defined retention period, and including by ordinary administrators changed exposure in practice, not merely whether a document or setting existed.
Related reading
Related definitions: ICT Response and Recovery Plan, Recovery Control.
Example
A ransomware attack encrypts the live settlement database. Operations recovers from a protected backup that ordinary compromised credentials cannot overwrite, then verifies integrity before replaying later events.
Comparison
An immutable backup is a backup copy that cannot be altered or deleted during a defined retention period, including by ordinary administrators or compromised production credentials. It differs from an offline backup because immutability describes resistance to modification, while offline or air-gapped storage describes connectivity; a resilient design may use both properties.
Key Takeaway
An immutable backup is a backup copy that cannot be altered or deleted during a defined retention period, including by ordinary administrators or compromised production credentials.
Sources
- StopRansomware Guide — Cybersecurity and Infrastructure Security Agency (2026-08-03)
- Incident Response Recommendations and Considerations, NIST SP 800-61 Rev. 3 — NIST (2026-08-03)
- Security and Privacy Controls for Information Systems and Organizations, NIST SP 800-53 Rev. 5 — NIST (2026-08-03)