Log in Request a demo

Glossary

Immutable Backup.

Also called immutable backups, WORM backup, write-once backup

In Short

An immutable backup is a copy of data that cannot be changed or deleted once it has been written. It helps an organization restore data even if an attacker gets into its systems. CISA advises keeping critical backups protected and offline, because many ransomware variants try to delete or encrypt backups they can reach.

Last updated October 23, 2026
Profile MapGlossary Term
  1. Also Called3other namesimmutable backups · WORM backup · write-once backup
  2. Related Terms3linked entriesRansomware · Incident response plan · Double extortion

What Is an Immutable Backup?

An immutable backup is a backup copy that cannot be altered or erased after it is created. The aim is simple: if the live systems are compromised, a clean copy of the data is still there. Immutability is a property of how the backup is stored. It is one part of a wider backup plan, not a plan on its own.

What Does CISA Say About Backup Storage?

CISA’s ransomware guide says to maintain offline, encrypted backups of critical data and to regularly test the availability and integrity of backups in a disaster recovery scenario. For cloud environments, CISA notes that some cloud vendors offer immutable storage solutions that can protect stored data without the need for a separate environment. In general terms, the stored data is locked so that it cannot be rewritten for a set period. The exact controls vary by system.

Which Attacker Techniques Go After Backups?

MITRE ATT&CK lists three techniques that damage data or the means to recover it. Immutable storage is one answer to each.

ID Technique What MITRE says
T1490 Inhibit System Recovery Adversaries may delete built-in recovery data and turn off recovery services. MITRE says this may deny access to available backups.
T1485 Data Destruction Adversaries may destroy data and files on specific systems or in large numbers. Overwriting makes the data irrecoverable by forensic means.
T1486 Data Encrypted for Impact Adversaries may encrypt data on many systems and withhold the key. MITRE names ransomware as the case where money is demanded for it.

MITRE lists data backup as a mitigation for all three. It says to store backups off system and protect them from the methods adversaries use to reach and destroy them.

What Happens When Backups Can Be Deleted?

CISA says it is important that backups are maintained offline, as many ransomware variants attempt to find and then delete or encrypt accessible backups. If that happens, restoring is impossible unless the ransom is paid. A backup that an attacker cannot change removes that option from the attacker. An organization that can restore its own data also has more choice when it faces a ransom demand.

Which Backup Habits Does CISA List?

These steps come from the CISA guide.

  • Maintain offline, encrypted backups of critical data.
  • Test backup procedures on a regular basis, and check both availability and integrity.
  • In the cloud, consider immutable storage where the provider offers it.
  • Use infrastructure as code to deploy and update cloud resources, and keep backups of the template files offline so resources can be redeployed quickly.
  • Consider a multi-cloud approach for cloud-to-cloud backups, in case all accounts with one provider are affected.

Is an Immutable Backup the Same as an Offline Backup?

No. An offline backup is kept disconnected from the network, so an attacker cannot reach it. An immutable backup may be online but is locked against change. Both aim to keep a clean copy safe. CISA’s guidance names offline backups as its main advice and mentions immutable storage as an option in the cloud.

Does an Immutable Backup Replace Testing?

No. A backup that cannot be changed is still only useful if it can be restored. CISA asks organizations to test backups on a regular basis, and that applies here too.

Where Can You Read More?

Related terms are ransomware, incident response plan and data breach.

Also Called.

  • Nameimmutable backups
  • NameWORM backup
  • Namewrite-once backup

Questions.

  • What is an immutable backup?

    An immutable backup is a copy of data that cannot be changed or deleted once it has been written. It helps an organization restore data even if attackers get into its systems.

  • Why do ransomware attackers target backups?

    CISA says many ransomware variants try to find and then delete or encrypt accessible backups. If that happens, restoring is impossible unless the ransom is paid.

  • Is an immutable backup the same as an offline backup?

    No. An offline backup is kept disconnected from the network so an attacker cannot reach it. An immutable backup may be online but is locked so it cannot be rewritten for a set period.

  • How can I use immutable backups safely?

    CISA advises maintaining offline, encrypted backups and testing their availability and integrity regularly. For cloud, some vendors offer immutable storage, which CISA says to use with caution because of compliance limits and misconfiguration cost.

Sources

  1. 1 #StopRansomware Guide, CISA
  2. 2 #StopRansomware: Play Ransomware, CISA
  3. 3 Inhibit System Recovery, T1490, MITRE ATT&CK
  4. 4 Data Destruction, T1485, MITRE ATT&CK
  5. 5 Data Encrypted for Impact, T1486, MITRE ATT&CK

In Our Research

  1. 1 Second Attack Wave on European Refrigeration Controllers: What Censys Counted and What Owners Do November 2026
  2. 2 NCSC: AI-Powered Ransomware on UK Critical Infrastructure Highly Likely by 2028 November 2026
  3. 3 Dell Data Domain: Seven Critical Flaws and the Build Each Release Line Needs October 2026
  4. 4 Veeam Fixes Five Flaws, One Critical, in Backup & Replication and Veeam ONE October 2026
  5. 5 Cybersecurity News This Week: 9 Stories That Mattered, 19 to 25 October 2026 October 2026
  6. 6 SafePay Ransomware Joint Advisory: Five Exploited Flaws and How to Close Them October 2026

Keep Exploring.

Knowledge Hub
Article Ransomware Examples: Attacks, Types And Groups Ransomware examples explained: five documented attacks, the main types of ransomware and the groups named in recent government advisories. Open Article Exposed PLCs: Lessons From The 2026 US Advisory US agencies say Iranian-affiliated actors disrupted exposed PLCs. See the attack flow and what water, energy and public facility operators should check. Open Threat group APT41 MITRE describes APT41 as a Chinese state-sponsored espionage group, as researchers have assessed it, that also runs financially motivated operations. The US Department of Justice charged five Chinese nationals in 2019 and 2020 and said the hacking reached more than 100 victims. Open Threat group Indrik Spider Attributed by MITRE ATT&CK to a Russia-based criminal group, which it also lists as Evil Corp. The US Treasury, the US Department of Justice and UK authorities name people behind the Dridex banking malware and later ransomware, and have sanctioned or charged them. Its work is stealing money from banks and extorting companies with ransomware. Open

Browse The Library.