Can your backups survive a ransomware attack?
Cyber insurance forms often ask whether your backups are immutable, air-gapped or offline. The real question is simpler: could an attacker delete your recovery copies before you need them?
Immutable backups: the small checkbox that can cause a big problem at renewal
Cyber insurance forms often ask whether you have immutable, air-gapped or offline backups. It sounds technical, but the question is really simple: could an attacker delete your backups before you need them?
This matters for small businesses, schools, care providers, trades and professional services across the UK. A backup on your network, controlled by normal admin accounts, may not be enough.
Why insurers ask about immutable backups
Ransomware groups know that backups are the route back to normal. So they often try to find and destroy them before encrypting live systems.
“Do you maintain immutable, air-gapped, or offline backups of your critical business data?”
The carrier is not asking whether you have some sort of backup. They are asking whether your backup copies would still be there if an attacker stole an admin password.
CISA warns that many ransomware variants look for accessible backups and delete or encrypt them to make recovery harder. The UK’s NCSC also recommends offline or ransomware-resistant backup approaches so an incident affecting live systems does not affect every recovery copy at the same time.
Immutable backup, defined
The useful test is not the product name. It is whether the backup copy can be changed or deleted during the retention period.
What it should mean
A backup copy is locked for a set period. Nobody can edit it, overwrite it or delete it during that window, including you, your IT provider, or an attacker using stolen admin credentials.
Terms you may see
Vendors may call this object lock, WORM storage, immutable storage, ransomware-resistant backup or protected retention. The wording varies. The control is what matters.
If your Microsoft 365 global admin, domain admin or normal backup admin account could delete the backup, it is not immutable in the way most insurance forms mean.
Three backup setups that often do not qualify
These setups can still have a place in a wider backup plan. The problem is assuming they answer the insurance question on their own.
A NAS or external drive in the office
A NAS in the server room is reachable from your network by design. If ransomware spreads across that network, it may reach the NAS too.
An external drive that is plugged in and left connected has a similar problem. It may be a copy, but it is not properly isolated.
Microsoft 365 retention treated as backup
Microsoft 365 has retention and recovery features, but that is not the same as having a separate backup platform.
Under the shared responsibility model, you remain responsible for protecting your own data, identities and access.
Cloud backup with immutability switched off
Many backup platforms support immutability, but it is not always enabled by default.
Your invoice may show a well-known backup product. That does not prove the lock is active on your account.
Three questions to send your IT provider before you sign the form
Copy these into an email before you tick yes on a cyber insurance renewal.
Are our backups immutable?
Many insurers now expect a meaningful retention window. Fourteen days is often treated as a basic floor, while 30 days is becoming a more sensible minimum for many organisations.
Could stolen admin credentials delete them?
The answer you want is no. If the same admin identity controls your live systems and your backup platform, the backup is exposed to the same compromise.
Can you prove the setting is enabled?
Verbal reassurance is not enough for something this important. Ask for something you can keep with your insurance paperwork.
Copy-and-paste email
Hi, we are reviewing our cyber insurance renewal and need to answer the backup question accurately.
Can you confirm whether our backups are immutable, air-gapped or offline?
If they are immutable, please confirm the retention window and whether a compromised domain admin or Microsoft 365 global admin account could delete them.
Could you also send a screenshot or vendor documentation showing that immutability is enabled on our account?
Thanks. What a stronger backup setup looks like
For small organisations, this does not need to be overcomplicated. It does need to be clear, tested and separated from normal admin access.
Immutability is turned on
The backup platform does not just support immutability as a feature. The setting is enabled, scoped correctly and visible in the admin portal.
Backup admin is separate
The credentials used to manage backups are separate from everyday Microsoft 365, domain or server admin accounts.
The window is long enough
The retention period gives you clean restore points from before an attacker arrived, not just a copy of yesterday’s already-compromised data.
Restores are tested
A backup that has not been restored is still a hope. Test restores should be recorded so you can show when the last successful test happened.
Microsoft 365 is included
Email, SharePoint, OneDrive and Teams data need their own backup plan. Native retention alone should not be treated as the whole answer.
Critical systems are mapped
You know what must be restored first: finance systems, case records, school MIS data, care records, email and shared files.
What to do if your honest answer is no
Do not panic, and do not guess. Declare what you have, then use the renewal process as the reason to fix the gap.
1. Check your current platform
Your existing backup product may already support immutability. In some cases, this is a configuration change rather than a new product purchase.
2. Ask for written confirmation
Ask your provider for the retention window, the admin separation model and proof that the setting is enabled.
3. Plan the fix before renewal
If the answer is unclear, deal with it before your next insurance renewal. You want time to improve the setup, not a rushed answer the week the form is due.
Do not tick yes just to avoid a harder conversation or a possible premium increase. For UK business insurance, you need to give a fair presentation of the risk. If a claim later shows the declared controls were not in place, that can create serious coverage problems.
Useful references
These are helpful sources to share with directors, governors, trustees or your IT provider.
- CISA StopRansomware Guide — recommends offline, encrypted and regularly tested backups because ransomware often targets accessible backups.
- NCSC ransomware-resistant backups guidance — UK guidance on reducing the impact of destructive ransomware attacks.
- NCSC offline backups in an online world — explains why at least one backup should remain unaffected by incidents hitting live systems.
- DfE Cyber Security Hub: 3-2-1 backup strategy — useful for schools, academies and education settings.
- Microsoft shared responsibility guidance — explains the split between cloud provider responsibilities and customer responsibilities.
Immutable backup FAQs
Straight answers to the questions that usually appear during cyber insurance renewal.
What does immutable backup mean in plain English?
It means a backup that nobody can change or delete for a set period, even if they have administrator credentials. The storage platform enforces the lock.
Is Microsoft 365 built-in retention a backup?
No. Retention is useful, but it is not the same as a separate backup platform. Microsoft provides the platform, but your organisation remains responsible for protecting its own data and access.
How long should the immutability window be?
Fourteen days is often seen as a basic starting point. Thirty days is a more sensible minimum for many small organisations because attackers can sit quietly inside systems before ransomware is triggered.
Can my IT provider just turn immutability on?
Often, yes. If your current backup platform supports it, the work may be a configuration change. Ask for written confirmation once it has been enabled.
Does an external hard drive count as immutable backup?
Not if it is regularly connected to your systems or left plugged in. It may be a backup copy, but it is not protected from the same ransomware incident if the attacker can reach it.
What happens if I answer yes when I should not?
That can cause problems during a claim. Cyber insurance applications should be answered honestly, and UK business insurance requires a fair presentation of risk.
Not sure what answer to give your insurer?
We can review your current backup position, help you ask the right questions, and explain what needs fixing before your next cyber insurance renewal.
Meet Kevin: Founder of Black Swan
Concerned about cyber security? Need advice or a tailor-made quote? Kevin is here to help you!
From actionable advice to helping you to see where you could be at risk, Kevin will help you to get your business on a path that is secure-by-design and ready for the unthinkable.
Ready to replace sleepless nights with peace of mind? It all starts with an informal chat!
Either schedule a call by selecting a suitable date and time on the calendar or by clicking the button below to send us a message.
Stay ahead of cyber threats - Subscribe to the Black Swan newsletter
Protect your school or business with expert advice tailored to schools and small businesses. Get the latest cyber threat insights, practical data protection tips, and guidance on password security, ransomware prevention, and compliance – all delivered straight to your inbox.
Join the Black Swan community today and take charge of your cyber security.
Click here to preview an example newsletter and see what you’ll gain by subscribing!