Immutable versus offline backups for ransomware recovery

Offline backups are disconnected from your network, so an attacker cannot reach them. Immutable backups stay online but cannot be changed or deleted for a set period. Both protect against ransomware tampering. CISA recommends offline, encrypted backups, and cautions that immutable storage may not meet certain regulatory criteria.

What the guidance says

CISA's guide says to maintain offline, encrypted backups of critical data and to test them regularly. It notes that many ransomware variants try to find and then delete or encrypt accessible backups. The NCSC says to keep offline backups separate, in a different location and ideally offsite, and not to rely on two copies on a single removable drive.

How they differ

Offline

• Physically or logically disconnected when not in use.
• Strong against remote attackers because there is no network path.
• Slower to restore and needs a process to keep it current.

Immutable

• Reachable, but write protected for a defined retention period.
• Faster to restore, and easier to automate.
• Protection depends on the product and how it is configured, and on who holds administrative control over the retention setting.

I have not found a source comparing the two on restore speed, so treat the speed points above as general characteristics to verify in your own tests.

The compliance caution

CISA's guide says immutable storage may not meet compliance criteria for certain regulations. A rule that requires you to delete personal data on request or after a fixed period can conflict with a copy you cannot alter. Check with your compliance and legal people before choosing.

Choosing

• Use at least one offline or otherwise isolated copy of critical data.
• If you add immutable storage, protect the account that can change its retention rules with separate credentials and MFA.
• Keep the restore path independent of your main directory.
• Test the restore from each copy, not just the primary.
• Scan backups before restoring, as the NCSC advises.

Common mistakes

• Assuming a cloud copy is immutable without checking the configuration and who can change it.
• Letting the backup admin account share credentials with the main directory.
• Testing only the fast copy and never the offline one.
• Forgetting that encrypted backups need their keys stored and recoverable somewhere separate.

Quick check

Sources

• CISA #StopRansomware Guide
• NCSC: Mitigating malware and ransomware attacks

Last reviewed: 19 October 2026.