Implementations may use write-once storage, object locking, retention controls, or a service that rejects destructive operations from customer identities. The property is meant to preserve earlier copies when ransomware, a compromised administrator, or an operational mistake affects production systems and connected backups.
Immutability must be evaluated against a specific threat model. A backup may be immutable yet remain online and reachable, so it is not automatically offline or air-gapped. An attacker may also corrupt or encrypt source data before it is captured, steal encryption keys, disable future backups, exhaust storage, or compromise the recovery environment. Multiple protected versions, separated administration, alerts, and tested restoration are still necessary.
Key points
Define the guaranteeRecord which data and metadata are protected, who can shorten or override retention, when deletion becomes possible and how policy changes are authorized and logged.
Separate controlUse distinct backup identities, strong authentication, least privilege, protected keys, restricted management paths and out-of-band recovery access where appropriate.
Verify recoverabilityMonitor backup jobs and capacity, retain versions long enough to predate delayed discovery, test clean restores and validate complete business services — not only file retrieval.
Important limitationImmutability protects stored recovery points from specified changes; it does not prove that they are complete, clean, decryptable, application-consistent, or restorable within business objectives.