What “Immutable Backup” Means on Your Cyber Insurance Form, and Why It Matters

Cyber insurance renewal forms include a question that catches out a lot of small business owners: “Do you maintain immutable, air-gapped, or offline backups of your critical business data?”

Most owners tick yes. They have backups, the backups run every night, and someone’s paid to keep an eye on them. That feels like a yes. But the question is more specific than that, and getting it wrong on the form can cost you far more than a bigger premium.

Why insurers started asking

Carriers added this question because ransomware operators worked out that the fastest way to force a payout is to wipe the backups first and encrypt everything else after. The Australian Cyber Security Centre has flagged the same pattern here, and it’s one of the most common moves in current ransomware playbooks. If your backup copies can be deleted with the same admin credentials an attacker just stole, you’ve got no recovery path other than paying up.

What “immutable” really means

An immutable backup can’t be modified or deleted for a fixed period, including by you, by your IT provider, and by anyone using stolen admin credentials. The stolen credentials part is what insurers care about most. Most backup systems can be wiped by anyone with admin access. Immutability means the backup platform enforces the lock at the storage layer itself, so no login, however privileged, can override it during the retention window. Different vendors call it object lock or WORM storage (write-once-read-many), but the underlying control is the same.

Three setups that don’t qualify, even though they feel like they should

A NAS or external drive in your office. Network-attached storage sitting in your server room is reachable from your network by design. If ransomware spreads across your environment, it can reach the NAS, and an attacker with domain admin credentials can wipe it. These devices have a role in a broader backup strategy, but on their own they don’t satisfy the immutability question.

Microsoft 365 retention treated as a backup. Retention features aren’t a backup in the sense the form means. Someone with global admin access to your tenant can delete data and purge retention holds. Under Microsoft’s shared responsibility model, backing up your own data stays your job, separate from what Microsoft handles at the platform level.

A cloud backup with immutability switched off. This is the most common gap we see. Plenty of reputable backup platforms include immutability as a feature, but it isn’t always turned on by default. A business can be paying for a backup solution that looks credible on paper while the immutability toggle sits off. You can’t tell from the outside without checking.

Three questions to send your IT provider before you sign

Copy these into an email before you check the box on the form.

“Are our backups immutable, and if so, how long is the immutability window?” Insurer guidance has tightened over the past two years, with 14 days now treated as a floor and 30 days increasingly the preferred minimum. Attackers can sit inside a network for weeks before triggering ransomware, so yesterday’s backup might already be compromised. The window needs to reach back far enough to give you a clean restore point.

“If our domain admin or Microsoft 365 global admin account were stolen tomorrow, could that account delete our backups?” The right answer is no. If it’s yes, or your provider isn’t sure, the backups aren’t immutable in the way the form means.

“Can you show me a screenshot or vendor documentation confirming immutability is enabled on our account?” A provider who can produce something concrete has done the work. Verbal reassurance with nothing to back it up is worth treating as a no until proven otherwise.

What a setup that genuinely qualifies looks like

A few things need to be true at once. Immutability needs to be turned on, not just available, on the backup platform, whether that’s Veeam, Datto, Rubrik, Acronis, or a cloud provider with S3-compatible object lock. A vendor name on the invoice doesn’t answer the question by itself.

Backup credentials need to sit outside your regular admin accounts. If the login that manages Microsoft 365 also controls the backup platform, one compromised account reaches both. The retention window needs to be long enough that a week-old intrusion still has a clean restore point behind it. And restores need to be tested. A backup nobody’s tried to restore in the last 12 months isn’t something to rely on when it matters most, and most carriers now ask for the date of your last successful restore test.

If your honest answer is no

Declare what you actually have on the form, and use the renewal as the trigger to fix the gap. Start by asking your IT provider whether immutability can be turned on for your existing platform. Often it already supports the feature and switching it on is a configuration change, not a new purchase, resolvable in a few days. If your provider can’t answer the three questions above clearly, that’s useful information in itself, and it’s worth sorting before your next renewal even if the rest of your IT setup is in good shape.

One thing worth avoiding: don’t check yes to dodge a premium increase. Cyber insurance applications work as warranty documents. If a forensic investigation after a claim finds your backups didn’t match what you declared, the carrier can rescind the policy, treat it as if it never existed, and claw back any prior payouts under the same term. Checking no will likely cost you something at renewal, either in premium or coverage terms, but that’s a known and manageable cost. Misrepresentation discovered after a claim is one of the more expensive mistakes a small business can make on an insurance form.

We help businesses across the Northern Beaches get their backup and disaster recovery setup to a point where the honest answer on that form is yes, with the immutability window, isolated credentials and tested restores an insurer wants to see. If a renewal’s coming up and you’d like a second set of eyes on your current setup before you sign anything, get in touch with our team at Vaelis IT.