Immutable backups What are immutable backups?
Immutable backups are copies of data written after and locked against modification, deletion, or encryption for a defined retention period. No user, administrator, or process can alter them. That includes ransomware. After written, the data stays exactly as it was at the moment of capture, giving organizations a verified, clean recovery point they can trust when everything else has been compromised.
Immutability is not a feature bolted onto conventional backup. It is a fundamentally different approach to data protection: one that assumes attackers will eventually reach your backup environment and ensures that, when they do, the data they find cannot be touched.
Time to read: 10 minutes, 13 seconds | Published: October 15, 2025
Table of Contents
Key takeaways
- Immutable backups are write-once, read-many data copies that cannot be modified or deleted for a set retention period, even by privileged users or ransomware.
- Immutability is distinct from standard backup because it removes the ability to overwrite or destroy protected data, not just the likelihood of doing so.
- Object lock, WORM storage, and air-gapped vaults are the three primary mechanisms used to enforce immutability at the storage layer.
- Regulatory frameworks including SEC Rule 17a-4, HIPAA, and GDPR explicitly require or strongly encourage immutable retention of certain data categories.
- HPE storage platforms deliver immutable data copies, continuous replication, and rapid recovery to minimize data loss and downtime from cyberattacks.
What immutable means in data storage
Immutability means a state that cannot be changed. In data storage, an immutable record is one that has been written and then locked: no subsequent process, credential, or instruction can alter or remove it until the defined retention period expires.
The term originates from functional programming, where immutable objects hold a fixed value for the life of a program. Storage engineers borrowed the concept and applied it to backup retention policies. The result is a class of backup data that behaves more like a legal record than a conventional data copy.
Three properties define truly immutable data:
- Write-once: Data is recorded after. No append, overwrite, or in-place edit is possible after the lock is set.
- Retention-locked: A time-based policy governs how long the lock holds. The lock cannot be shortened by anyone below a defined administrative threshold, and in governance mode, it cannot be shortened at all.
- Tamper-evident: Any attempt to change or delete the data is logged, rejected, and, in most implementations, triggers an alert.
These three properties together give immutability its value. It is not enough for data to be difficult to delete. Immutability means deletion is technically impossible within the retention window.
Why organizations need immutable backups
Ransomware operators have learned to target backup infrastructure first. Modern ransomware strains actively seek out and encrypt or delete backup catalogs before attacking production systems, knowing that destroying recovery options maximizes the pressure to pay. A conventional backup that an attacker can reach is not a backup. It is a liability.
Immutable backups remove that leverage. A data copy that cannot be encrypted or deleted gives the organization a clean recovery point regardless of how far an attack has spread.
Beyond ransomware, three additional pressures drive adoption:
- Regulatory compliance: Financial services regulators, healthcare authorities, and data protection laws in multiple jurisdictions mandate tamper-proof retention of certain record categories. Immutable backups satisfy those requirements in a way that conventional, deletable backups cannot.
- Insider threat: Privileged users, including backup administrators, can intentionally or accidentally destroy conventional backups. Immutability removes that risk by making deletion impossible, not merely unauthorized.
- Audit confidence: When a regulator, auditor, or incident response team asks for records from a specific date, immutable backups provide a mathematically verifiable answer: the data is exactly what it was at the time of capture.
Immutable backups are the most direct technical countermeasure for ransomware available at the data layer.
How immutable backups work
Immutability is enforced at the storage layer, not the application layer. The mechanism that creates the lock sits below the backup software, which means even a compromised backup application cannot override it.
The general process works as follows:
- Data is written to a protected storage target. The backup job completes normally, transferring data to a designated repository, object store, or tape system.
- An object lock or WORM policy is applied. Immediately after the write completes, the storage system applies a retention lock. From this point, the data object is read-only for the duration of the retention period.
- The storage system enforces the lock at the hardware or firmware layer. Attempts to delete, overwrite, or change the object return an error. Administrative credentials do not bypass the lock in governance or compliance mode.
- The retention clock runs. When the defined period expires, the lock releases and the data can be deleted or overwritten by authorized processes.
- Activity is logged. All access attempts, successful reads, and rejected modification attempts are recorded in an audit trail that is itself typically protected.
Some implementations add a second layer of protection through air gapping, physically or logically isolating the immutable copy from any network-connected system. This prevents an attacker who has compromised network credentials from even reaching the backup storage target.
The difference between regular backups and immutable backups
Standard backups create recoverable copies of data, but those copies remain mutable: they can be overwritten by a new backup job, deleted to free storage space, or encrypted by ransomware that reaches the backup environment. The protection a conventional backup offers depends entirely on access controls remaining intact.
Immutable backups change the assumption. The protection does not depend on access controls. It is enforced at the storage layer and cannot be bypassed by compromised credentials.
The table below summarizes the key differences:
| Attribute | Regular backup | Immutable backup |
|---|---|---|
| Can be deleted before retention period expires | Yes, by authorized users | No, lock is enforced at storage layer |
| Vulnerable to ransomware encryption | Yes, if ransomware reaches the backup target | No, locked objects reject write operations |
| Requires valid credentials to protect | Yes | No, lock persists regardless of credential state |
| Supports regulatory write-once compliance | No | Yes |
| Recovery point reliability after attack | Uncertain | High: data is exactly as written |
| Typical storage cost | Lower | Slightly higher due to object lock overhead |
| Air-gap compatibility | Optional | Frequently combined for defense in depth |
The distinction matters most during a ransomware incident. When production systems are encrypted and the backup catalog is compromised, a regular backup might be gone. An immutable backup is exactly where it was when it was written.
Types of immutable data backup
Organizations implement immutability through three primary mechanisms, each with distinct characteristics.
Object lock storage
Object lock is a capability built into object storage systems, including Amazon S3, HPE storage platforms, and on-premises object stores. When an object lock policy is applied, it enforces write-once retention at the API level. Two modes are available:
- Governance mode: Users with specific IAM permissions can remove the lock. Suitable for internal compliance where administrative override is occasionally needed.
- Compliance mode: No user, including the root account, can remove the lock before the retention period expires. Required for strict regulatory compliance.
WORM storage
Write After Read Many (WORM) storage enforces immutability at the hardware or firmware level. Traditional magnetic tape in WORM mode and certain disk appliances use this approach. After data is committed, the media or firmware controller prevents any further write operations to that location. WORM is common in industries with long retention mandates, such as financial services and life sciences.
Air-gapped and vaulted backups
An air gap physically or logically separates the backup copy from any network-connected system. An air-gapped immutable backup combines two independent protections: the attacker cannot reach the storage target over the network, and even if physical access were obtained, the lock prevents modification. HPE Cyber Resilience Vault uses this approach to create an isolated recovery environment for the most critical workloads.
Real-world uses of immutable data
Immutable data is not an abstract security concept. Organizations across multiple industries use it to solve specific, concrete problems.
Financial services
Regulations including SEC Rule 17a-4 and FINRA Rule 4370 require broker-dealers to retain electronic records in a non-rewriteable, non-erasable format for defined periods. Immutable object storage satisfies these requirements and provides the audit trail regulators expect during examinations.
Healthcare
Hospitals and health networks protect patient records against both ransomware and accidental deletion by writing clinical data to immutable backup targets. The Slovenj Gradec General Hospital, for example, deployed HPE Zerto Software alongside HPE storage infrastructure to protect patient data and clinical systems, nearly eliminating the risk of service disruption from ransomware or downtime.
Legal and compliance
Law firms and corporate legal departments retain case records, contracts, and correspondence in immutable storage to satisfy e-discovery obligations and prevent spoliation claims. An immutable record is a defensible record.
Manufacturing and operational technology
Manufacturers use immutable backups to protect production system configurations, firmware images, and quality records. A corrupted or encrypted configuration on a production line can halt output for days. A verified, immutable copy restores operations in minutes.
Public sector and critical infrastructure
Government agencies and utility operators protect citizen records and control system data with immutable retention policies, supporting both audit requirements and continuity of essential services.
Benefits of immutable data for security
Immutability delivers five specific security outcomes that conventional backup cannot replicate.
Ransomware resistance
Ransomware encrypts data by writing new content more than existing files. An immutable lock returns an error when ransomware attempts to write. The attack reaches the backup target, finds it cannot change anything, and leaves the recovery point intact.
Insider threat elimination
A disgruntled or negligent administrator cannot delete an immutable backup. The lock applies regardless of the credential level of the person making the request, removing one of the most difficult attack vectors to detect and prevent.
Regulatory compliance assurance
Immutable retention policies produce the non-rewriteable, non-erasable records that financial, healthcare, and data protection regulators require. Compliance becomes a technical guarantee, not a policy commitment that depends on consistent human behavior.
Clean recovery point verification
After a cyberattack, incident responders need to know that the recovery point they are using has not been tampered with. An immutable backup provides mathematical certainty: the data is byte-for-byte identical to what was written at capture time.
Reduced recovery time
When a clean, verified recovery point is available, recovery operations can begin immediately. Organizations do not lose time investigating whether the backup is trustworthy. This directly reduces recovery time objective (RTO) and the total business cost of an incident.
Immutable backup challenges
Immutable backups solve important problems, but they introduce operational considerations that organizations need to plan for.
Storage cost
Immutable copies cannot be deleted or deduplicated within the retention window. Storage consumption grows as new backups accumulate alongside locked historical copies. Organizations need accurate capacity forecasting and tiered storage policies to manage cost.
Retention policy design
Setting retention periods requires deliberate analysis. A period that is too short fails to protect against slow-moving attacks that remain dormant for weeks before triggering. A period that is too long increases storage consumption and might complicate data subject access requests under privacy regulations.
Recovery testing
An immutable backup that has never been tested for recovery is an assumption, not a capability. Regular, non-disruptive recovery testing, supported by automation in platforms such as HPE Zerto Software, is essential to confirm that locked data can actually be restored within the required time frame.
Compliance mode irreversibility
In strict compliance mode, a retention period that is set incorrectly cannot be shortened. If a misconfiguration locks data for 10 years when the intent was 10 days, that data cannot be released until the period expires. Governance controls and testing environments are critical before compliance mode is applied to production data.
Integration complexity
Not all backup software integrates natively with object lock or WORM storage. Organizations evaluating immutable backup solutions need to verify that their backup application can apply and verify locks as part of the normal backup workflow, not as a manual post-processing step.
How to choose the right immutable backup approach
Selecting an immutable backup strategy requires matching technical capabilities to regulatory requirements, recovery objectives, and operational constraints.
Consider the following criteria:
- Regulatory mandate: Identify which regulations apply to your data categories. Financial records subject to SEC Rule 17a-4 require compliance mode object lock or certified WORM media. Other frameworks might accept governance mode.
- Recovery time objective: Immutable object storage on flash-based systems restores data faster than tape WORM. If your RTO is measured in minutes, the storage tier matters as much as the immutability mechanism.
- Retention period: Match the lock duration to the longest applicable regulatory or business retention requirement. Build in buffer for slow-moving threats.
- Air-gap requirement: For the most critical workloads, evaluate whether immutability alone is sufficient or whether physical isolation through a cyber resilience vault adds necessary protection.
- Integration with continuous data protection: Point-in-time snapshots with object locks protect data as it was at the moment of the snapshot. Continuous data protection, as delivered by HPE Zerto Software, replicates changes in near real-time and applies immutable journal entries, enabling recovery to a point seconds before an attack rather than hours.
- Testing capability: Select a platform that supports non-disruptive recovery testing so you can verify recoverability without interrupting production operations or consuming the locked backup data.
How HPE supports immutable data protection
Your backup data is only as valuable as its integrity. HPE delivers immutable data protection through a portfolio of integrated storage and software solutions built to keep recovery points verifiable, clean, and accessible when organizations need them most.
HPE StoreOnce Systems helps protect backup data from ransomware and unauthorized changes with data immutability for HPE StoreOnce Catalyst stores. Once backup data is marked immutable, it cannot be modified or deleted during its defined retention period, helping preserve a trusted recovery copy for restore.
HPE StoreOnce adds layers of cyber resilience with encryption, dual authorization, data integrity checks, and air-gapped options. Combined with high-performance backup, rapid recovery, and deduplication, these capabilities help organizations protect recovery data, reduce backup storage requirements, and maintain recoverable copies across edge, datacenter, and hybrid environments. HPE Zerto Software provides cyber resilience using continuous data protection through real-time replication and journal-based recovery. Where conventional backups create point-in-time snapshots that might be hours old when an attack strikes, HPE Zerto Software maintains a continuous journal of changes and delivers data copies that can be made immutable on supported storage for recovery to a known clean point before an encryption event. TenCate Protective Fabrics, after suffering a ransomware attack that required two weeks to recover from, deployed HPE Zerto Software and reduced recovery time from two weeks to under 10 minutes, with data loss dropping from 12 hours to 10 seconds.
Key capabilities include:
- Real-time encryption detection that identifies ransomware activity as it occurs
- Journal-based recovery points that can be made immutable so they cannot be altered by a compromised system
- Non-disruptive recovery testing to verify recoverability without consuming production resources
- Automated orchestration that reduces manual steps and accelerates failover execution
- Support for on-premises, hybrid, and multicloud environments including HPE Morpheus Software, VMware, Microsoft Hyper-V, Microsoft Azure, and AWS
HPE storage platforms including HPE Alletra Storage MP B10000 and HPE Alletra Storage MP X10000 deliver built-in ransomware detection, 100% data availability guarantees, and integrated backup capabilities at the storage layer. HPE Alletra Storage MP B10000 uses HPE Virtual Lock to create immutable snapshots that cannot be altered or deleted before the retention period expires, protecting clean recovery points from ransomware and administrative compromise. HPE Alletra Storage MP X10000 provides S3-compatible object storage for modern data protection, enabling backup applications to retain protected object copies and support rapid, flash-speed recovery.
HPE Cyber Resilience Vault combines physical isolation with immutable data copies to create a hardened recovery environment for the most critical workloads. When an attack compromises production and network-accessible backup infrastructure, the vault provides an isolated, verified copy that attackers cannot reach.
HPE is recognized as a Leader in the 2026 Gartner Magic Quadrant for Enterprise Storage Platforms, reflecting the breadth and depth of its data protection capabilities across hybrid cloud environments.
Your recovery depends on data you can trust. HPE makes that data immutable.
Immutable backup FAQs
What are immutable backups and why do I need them?
Immutable backups are data copies locked against modification or deletion for a defined retention period. You need them because ransomware actively targets and destroys conventional backups before encrypting production systems. An immutable backup cannot be encrypted, deleted, or altered, even by an attacker with administrative credentials. It gives you a verified, clean recovery point when production data and standard backups have been compromised.
How do immutable backups protect data from ransomware?
Ransomware encrypts data by issuing write operations to storage. Immutable object lock and WORM mechanisms reject write operations at the storage layer. When ransomware reaches an immutable backup target, it cannot change the data. The locked copy remains intact, enabling recovery to a clean state without paying a ransom or accepting extensive data loss.
What is the difference between object lock governance mode and compliance mode?
Governance mode allows users with specific administrative permissions to remove or shorten a retention lock before it expires. Compliance mode allows no one, including root or super administrator accounts, to change or remove the lock until the retention period expires. Compliance mode is required for regulatory mandates such as SEC Rule 17a-4. Governance mode suits internal compliance scenarios where occasional administrative override might be needed.
How does immutable data actually work at the storage layer?
When a backup job completes, the storage system applies a retention policy to the written objects. The object lock API or WORM firmware controller marks the object as non-writable for the duration of the retention period. Any subsequent API call or command that attempts to overwrite, delete, or change the object is rejected at the storage layer, below the operating system and below the backup application. The rejection is logged in the storage system's audit trail.
Is an air-gapped backup the same as an immutable backup?
No. An air gap and immutability are independent protections that are often combined. An air-gapped backup is isolated from network access, preventing an attacker from reaching it more than the network. An immutable backup cannot be modified even if an attacker reaches it. A backup can be air-gapped but mutable, or immutable but network-accessible. Combining both mechanisms, as HPE Cyber Resilience Vault does, provides the strongest available protection.
Does immutability affect backup deduplication and compression?
Yes. Deduplication and compression typically require reading and rewriting data, which immutability prevents within the retention window. Most implementations apply deduplication and compression before the lock is set, during the ingest stage. Organizations need to account for reduced storage efficiency when comparing immutable backup storage consumption to conventional deduplicated backup storage.
What regulations require immutable data retention?
SEC Rule 17a-4 requires broker-dealers to retain electronic records in a non-rewriteable, non-erasable format. FINRA Rule 4370 imposes similar requirements. HIPAA requires audit controls and retention of health records in a manner that detects unauthorized modification. GDPR requires demonstrable data integrity controls. Industry-specific standards including PCI DSS and CJIS also drive immutable retention adoption. Requirements vary by jurisdiction and data category; legal review is essential before selecting a retention mode.