---
title: "Immutable backup"
description: "An immutable backup cannot be altered or deleted for a set period. Learn the WORM model, ransomware protection and the 3-2-1-1-0 backup rule."
url: "https://nodea.io/en/glossary/immutable-backup"
lang: "en"
updated: "2026-07-13"
---

# Immutable backup

> An immutable backup is a backup that cannot be modified or deleted for a defined period — not even by an administrator. It is a key defense against ransomware and deliberate data sabotage.

An **immutable backup** is a backup protected so that, for a defined retention period, it cannot be modified, overwritten or deleted — including by an authorized administrator or a process running with their privileges. This protection is enforced at the storage layer itself, independent of application-level permissions, which makes it the final, tamper-proof line of defense in a [backup](https://nodea.io/en/glossary/backup) strategy.

## How an immutable backup works

The technical foundation is the **WORM** (Write Once, Read Many) model — data, once written, can be read any number of times, but for the duration of the lock it cannot be changed. This is implemented in several ways: through Object Lock in S3-compatible [object storage](https://nodea.io/en/glossary/object-storage), dedicated backup repositories with a set retention, or read-only snapshots of a file system. The lock usually comes in two modes: *governance*, which allows exceptions for selected privileges, and the stricter *compliance* mode, where no one can tamper with the backup until the retention period ends.

## Practical application

Immutable backups have become a standard defense against [ransomware](https://nodea.io/en/glossary/ransomware), because modern attacks deliberately destroy backups before encrypting production data. They extend the classic 3-2-1 rule, now expanded to **3-2-1-1-0**: three copies of data, on two different media, one off-site, one immutable or offline, and zero errors when verifying restores. Immutable backups are also frequently a regulatory requirement in finance and healthcare. When implementing them, it pays to align the retention period with your [RTO and RPO](https://nodea.io/en/glossary/rto-and-rpo) targets and with a broader disaster recovery plan, so that locked copies genuinely shorten the time to recover after an incident.

### Why does an immutable backup protect against ransomware?

Modern ransomware deliberately encrypts or deletes backups before hitting production data, so the victim cannot recover. An immutable backup is locked at the storage layer for a set period, so even a compromised administrator account cannot tamper with it.

### What is the WORM model?

WORM (Write Once, Read Many) is a storage principle where data, once written, can be read many times but cannot be overwritten or deleted for a defined retention period. It is the technical basis of immutable backups, originally derived from archival media.

## Related

- [Backup](https://nodea.io/en/glossary/backup)
- [Ransomware](https://nodea.io/en/glossary/ransomware)
- [Object storage](https://nodea.io/en/glossary/object-storage)
- [RTO and RPO](https://nodea.io/en/glossary/rto-and-rpo)
- [DRP (Digital Risk Protection)](https://nodea.io/en/glossary/digital-risk-protection)

---

Languages: [pl](https://nodea.pl/pl/slownik-pojec/immutable-backup.md)  
Site index: [llms.txt](https://nodea.io/en/llms.txt)