# What is an Immutable Backup?

> An immutable backup is a backup whose retained recovery points are protected from alteration or deletion for a defined period.

- Canonical URL: https://yellowcube.eu/glossary/immutable-backup/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Implementations may use write-once storage, object locking, retention controls, or a service that rejects destructive operations from customer identities. The property is meant to preserve earlier copies when ransomware, a compromised administrator, or an operational mistake affects production systems and connected backups.

Immutability must be evaluated against a specific threat model. A backup may be immutable yet remain online and reachable, so it is not automatically offline or air-gapped. An attacker may also corrupt or encrypt source data before it is captured, steal encryption keys, disable future backups, exhaust storage, or compromise the recovery environment. Multiple protected versions, separated administration, alerts, and tested restoration are still necessary.

### Key points

- **Define the guarantee:** Record which data and metadata are protected, who can shorten or override retention, when deletion becomes possible and how policy changes are authorized and logged.
- **Separate control:** Use distinct backup identities, strong authentication, least privilege, protected keys, restricted management paths and out-of-band recovery access where appropriate.
- **Verify recoverability:** Monitor backup jobs and capacity, retain versions long enough to predate delayed discovery, test clean restores and validate complete business services — not only file retrieval.
- **Important limitation:** Immutability protects stored recovery points from specified changes; it does not prove that they are complete, clean, decryptable, application-consistent, or restorable within business objectives.

### Related terms

[Backup](<https://yellowcube.eu/glossary/backup/>) · [Air gap](<https://yellowcube.eu/glossary/air-gap/>) · [Disaster recovery](<https://yellowcube.eu/glossary/disaster-recovery/>) · [Recovery point objective (RPO)](<https://yellowcube.eu/glossary/recovery-point-objective/>) · [Ransomware](<https://yellowcube.eu/glossary/ransomware/>) · [Data integrity](<https://yellowcube.eu/glossary/data-integrity/>)

### Sources

[CISA #StopRansomware Guide](https://www.cisa.gov/stopransomware/ransomware-guide) · [UK NCSC ransomware-resistant backups](https://www.ncsc.gov.uk/collection/ransomware-resistant-backups) · [UK NCSC principles for ransomware-resistant cloud backups](https://www.ncsc.gov.uk/collection/ransomware-resistant-backups/principles-for-ransomware-resistant-cloud-backups)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.