What Immutable Backup Means on Your Cyber Insurance Form

There’s a question on cyber insurance applications that catches a lot of business owners off guard. It usually reads something like this:

“Do you maintain immutable, air-gapped, or offline backups of your critical business data?”

Most people check yes. You have backups, and they run every night. That feels like a yes.

But the insurer is asking something more specific. If an attacker had your admin password right now, could they delete your backups before you noticed?

Carriers added this question because ransomware gangs figured out that the fastest way to force a payout is to wipe the backups first, then encrypt everything else. CISA, the FBI and the Internet Crime Complaint Center have all documented this pattern. If your backups can be deleted with the same admin login an attacker just stole, paying the ransom may be your only way back.

What immutable actually means

An immutable backup can’t be changed or deleted for a set period of time. Not by you, not by your IT provider and not by anyone using stolen admin credentials.

That last part is what insurers care about. With most backup systems, anyone with admin access can wipe them. Immutability means the storage itself enforces the lock, and no login, however powerful, can override it during the retention window. You’ll also see it called object lock, write-once-read-many or WORM storage.

Three setups that usually don’t qualify

A NAS or external drive in the office. A network storage box is reachable from your network by design, so ransomware that spreads across your systems can reach it too. It’s useful, but not enough on its own.

Microsoft 365’s built-in retention. Retention features aren’t a backup in the sense the form means. Someone with global admin access can delete data and purge retention holds. Under Microsoft’s shared responsibility model, backing up your data is your job. If native retention is your only protection, the honest answer is no.

A cloud backup with immutability turned off. Many reputable backup platforms offer immutability, but it isn’t always on by default. You could be paying for a solid product with the switch in the off position.

Three questions to send your IT provider

1. “Are our backups immutable, and how long is the immutability window?” Attackers sometimes sit in a network for weeks before launching ransomware, so the window needs to be long enough to give you clean restore points from before they got in.
2. “If our domain admin or Microsoft 365 global admin account were stolen tomorrow, could it be used to delete our backups?” The right answer is no. If it’s yes, or “not sure,” your backups aren’t immutable in the way the form means.
3. “Can you send me a screenshot or documentation showing immutability is turned on for our account?” Verbal reassurance with nothing to show should be treated as a no for now.

What a qualifying setup looks like

A few things need to be true at the same time:

• Immutability is actually turned on, not just available as a feature.
• The backup logins are separate from your everyday admin accounts, so one stolen account can’t reach both.
• The retention window is long enough. A backup that overwrites itself daily won’t help if the attacker has been inside for a week.
• Restores get tested. CISA’s #StopRansomware Guide lists immutable, tested backups as a baseline control. Insurers ask about this directly. Beazley’s ransomware supplemental application, for example, asks whether any of your backups are immutable and how often you perform a test restoration.

If your honest answer is no

Say so on the form. Then use the renewal as the reason to fix it.

Ask whether immutability can be turned on in the platform you already have. Often it’s a settings change, not a new purchase. If your provider can’t answer the three questions above, that tells you something too.

One thing to avoid: don’t check yes to dodge a premium increase. Insurance applications are treated as warranty documents, so your answers count as promises. If an investigation after a claim finds your backups didn’t match what you declared, the insurer can rescind the policy. That means it’s treated as if it never existed.

Checking no will probably cost you something at renewal. That cost is known and manageable. Losing your coverage after an incident is not. It’s worth talking the form through with your insurance broker too.

Backups that hold up to this question are what our cloud backup and disaster recovery work is built around. If you’ve got a renewal coming up and want a second set of eyes on your setup, reach out or call (888) 933-2975.