Why Your Cyber Insurance Renewal Asks About Immutable Backups

Somewhere on your cyber insurance renewal application is a question that stops a lot of business owners cold: do you maintain immutable, air-gapped, or offline backups of your critical business data?

Carriers added that question because ransomware operators figured out that the fastest way to force a payout is to destroy the backups first and encrypt everything else afterward. CISA, the FBI, and the Internet Crime Complaint Center have all documented this as one of the most common moves in current ransomware playbooks. If an attacker can delete your backups with the same admin credentials they just stole, your only recovery path is paying the ransom.

What immutable actually means

An immutable backup cannot be changed or deleted for a fixed period of time, not by you, not by your IT provider, and not by anyone holding stolen admin credentials. The lock is enforced at the storage layer, so no level of privilege can override it during the retention window. Vendors call it object lock, WORM, or write-once-read-many. The label changes, but the control is the same.

Three setups that do not qualify

A NAS or external drive in your office is reachable from your network by design, which means ransomware can reach it too. These devices have a place in a broader strategy, but on their own they do not answer the question on the form.

Microsoft 365 retention is not a backup in the sense the application means. A global admin, or anyone who steals one, can delete data and purge retention holds. Microsoft's shared responsibility model places backup of your data squarely on you.

A cloud backup with immutability switched off is the most common gap we find in businesses along the Gulf Coast. The feature exists on most reputable platforms, but it is not always enabled by default, and you cannot tell from the outside without checking.

Three questions to send your IT provider

Send these before you check the box.

First, are our backups immutable, and how long is the immutability window? Most insurers now treat 14 days as a floor and 30 days as the preferred minimum, because attackers often sit inside a network for weeks before triggering encryption.

Second, if our domain admin or Microsoft 365 global admin account were stolen tomorrow, could that account be used to delete our backups? The correct answer is no.

Third, can you send documentation showing that immutability is enabled on our account? Verbal reassurance with nothing to show should be treated as a no.

What a qualifying setup looks like

Immutability has to be turned on, not merely available. Veeam, Datto, Rubrik, Acronis, and most S3-compatible storage providers support it, but a vendor name on the invoice does not answer the question by itself. Backup credentials need to sit outside your everyday administrative accounts so that one compromised login cannot reach both. The retention window needs to be long enough to give you a clean restore point from before the intruder arrived. And restores need to be tested, because most carriers now ask for the date of your last successful restore test.

If your honest answer is no

Declare what you actually have, then use the renewal date as your deadline to fix the gap. In many cases immutability is already supported on the platform you own, and switching it on is a configuration change rather than a new purchase.

Do not check yes to dodge a premium increase. Cyber insurance applications function as warranty documents. If a forensic investigation after a claim finds that your backups did not match what you declared, the carrier can rescind the policy and claw back prior payouts under the same term. Checking no will likely cost you something at renewal, and that cost is known and manageable. Misrepresentation is neither.

Cyclone 365 helps Gulf Coast businesses enable immutable backups, isolate backup credentials, verify restores, and produce the documentation carriers want to see. If you would rather answer that question with confidence at your next renewal, reach out to Cyclone 365 before the form is due. Call or Email us today!