Immutable backup
An immutable backup is a backup protected against alteration or premature deletion for a configured protection period. What is protected, and whether an administrator can remove the lock, depends on the service and its settings.
Check the lock, not just the label
Immutability helps preserve recovery points when someone tries to remove or change them. It does not mean every copy is kept forever, or that every backup operation has the same protection.
Azure Backup distinguishes enabled immutability from enabled and locked immutability. The enabled setting can be disabled; locking makes that setting irreversible. AWS Backup similarly distinguishes governance mode, removable by sufficiently privileged users, from compliance mode after its grace period. Check the exact mode and which recovery points it covers. Azure also supports a fixed immutability duration that can end before the backup’s retention period does. A retained backup is not necessarily still immutable.
These are product-specific controls. Do not assume that a source workload, an operational backup, and a vaulted recovery point are all covered by the same lock.
Retained does not mean ready to restore
A protected copy may still be incomplete, contain unwanted changes from before collection, or depend on keys and infrastructure needed for recovery. Immutability does not demonstrate that a restore will work or that the restored application will meet business needs. Test recovery separately.
It also does not undo data theft. Restoring a system can address availability while an attacker still holds information copied earlier. The extortion-claim article explains why claims of theft need their own investigation.
The backup-protection article distinguishes retention safeguards, additional approval, and deletion recovery. A maintenance request should name the exact operation and affected recovery points before anyone approves a protection change.