Log in Request a demo

Glossary

Immutable Backup.

Also called immutable backups, WORM backup, write-once backup

In Short

An immutable backup is a copy of data that cannot be changed or deleted once it has been written. It helps an organization restore data even if an attacker gets into its systems. CISA advises keeping critical backups protected and offline, because many ransomware variants try to delete or encrypt backups they can reach.

Last updated October 9, 2026
Profile MapGlossary Term
  1. Also Called3other namesimmutable backups · WORM backup · write-once backup
  2. Related Terms3linked entriesRansomware · Incident response plan · Double extortion

What is an immutable backup?

An immutable backup is a backup copy that cannot be altered or erased after it is created. The aim is simple: if the live systems are compromised, a clean copy of the data is still there. Immutability is a property of how the backup is stored. It is one part of a wider backup plan, not a plan on its own.

How does it work?

CISA’s ransomware guide says to maintain offline, encrypted backups of critical data and to regularly test the availability and integrity of backups in a disaster recovery scenario. For cloud environments, CISA notes that some cloud vendors offer immutable storage solutions that can protect stored data without the need for a separate environment. In general terms, the stored data is locked so that it cannot be rewritten for a set period. The exact controls vary by system.

Why does it matter?

CISA says it is important that backups are maintained offline, as many ransomware variants attempt to find and then delete or encrypt accessible backups. If that happens, restoring is impossible unless the ransom is paid. A backup that an attacker cannot change removes that option from the attacker. Reasoning cautiously, an organization that can restore its own data also has more choice when it faces a ransom demand.

How can you reduce the risk?

These steps come from the CISA guide.

  • Maintain offline, encrypted backups of critical data.
  • Test backup procedures on a regular basis, and check both availability and integrity.
  • In the cloud, consider immutable storage where the provider offers it.
  • Use infrastructure as code to deploy and update cloud resources, and keep backups of the template files offline so resources can be redeployed quickly.
  • Consider a multi-cloud approach for cloud-to-cloud backups, in case all accounts with one provider are affected.

Is an immutable backup the same as an offline backup?

No. An offline backup is kept disconnected from the network, so an attacker cannot reach it. An immutable backup may be online but is locked against change. Both aim to keep a clean copy safe. CISA’s guidance names offline backups as its main advice and mentions immutable storage as an option in the cloud.

Does an immutable backup replace testing?

No. A backup that cannot be changed is still only useful if it can be restored. CISA asks organizations to test backups on a regular basis, and that applies here too.

See also ransomware, incident response plan and data breach.

Also Called.

  • Nameimmutable backups
  • NameWORM backup
  • Namewrite-once backup

Questions.

  • What is an immutable backup?

    An immutable backup is a copy of data that cannot be changed or deleted once it has been written. It helps an organization restore data even if attackers get into its systems.

  • Why do ransomware attackers target backups?

    CISA says many ransomware variants try to find and then delete or encrypt accessible backups. If that happens, restoring is impossible unless the ransom is paid.

  • Is an immutable backup the same as an offline backup?

    No. An offline backup is kept disconnected from the network so an attacker cannot reach it. An immutable backup may be online but is locked so it cannot be rewritten for a set period.

  • How can I use immutable backups safely?

    CISA advises maintaining offline, encrypted backups and testing their availability and integrity regularly. For cloud, some vendors offer immutable storage, which CISA says to use with caution because of compliance limits and misconfiguration cost.

Sources

  1. 1 #StopRansomware Guide | CISA, CISA

In Our Research

  1. 1 Ransomware examples: attacks, types and groups October 2026
  2. 2 Exposed PLCs: lessons from the 2026 US advisory October 2026
  3. 3 Akira ransomware advisory AA24-109A: stages and tools October 2026
  4. 4 Top 10 Ransomware Variants Reported to the FBI in 2025 October 2026
  5. 5 What Is Triple Extortion? The Anatomy of the Encryption + Leakage + DDoS Trio April 2026
  6. 6 Reynolds Ransomware: BYOVD Evasion & NSecKrnl Abuse February 2026

Keep Exploring.

Knowledge Hub
Article WIZARD SPIDER: The Financial Empire Behind Global Ransomware Operations Wizard Spider profile: aliases such as FIN12 and GOLD BLACKBURN, activity since 2016, and its role in TrickBot, Ryuk, Conti and Black Basta operations. Open Article Sandworm (APT44): Russia’s Most Destructive Cyber Weapon Sandworm (APT44) profile: aliases, motives, tactics, targets and notable operations, including NotPetya and the AcidPour wiper on critical infrastructure. Open Threat group APT41 MITRE describes APT41 as a Chinese state-sponsored espionage group, as researchers have assessed it, that also runs financially motivated operations. The US Department of Justice charged five Chinese nationals in 2019 and 2020 and said the hacking reached more than 100 victims. Open Threat group Indrik Spider Attributed by MITRE ATT&CK to a Russia-based criminal group, which it also lists as Evil Corp. The US Treasury, the US Department of Justice and UK authorities name people behind the Dridex banking malware and later ransomware, and have sanctioned or charged them. Its work is stealing money from banks and extorting companies with ransomware. Open

Browse The Library.