Immutable backup and air-gapped backup solve different problems. Immutability prevents stored backup data from being modified or deleted until a retention period ends. An air gap keeps a backup copy out of reach of the network and of everyday production credentials. Most production environments benefit from both, because one limits what an attacker can do to reachable data and the other limits what an attacker can reach.
Key Takeaways
Different control points: immutability is enforced by the storage or backup layer (write and delete are refused); an air gap is enforced by isolation (no standing connection or access path).
Immutable data stays online and restores fast; air-gapped data trades restore speed for isolation. Tape is the classic example.
"Immutable" is only as strong as whoever can change the retention policy. A policy that a privileged user can bypass is not immutability in the strict sense.
Neither control cleans the data. Both will faithfully preserve a backup of already-encrypted or infected data.
CISA's guidance is to keep offline, encrypted, regularly tested backups. Immutable repositories are a complementary control, not a formal replacement for that recommendation.
A practical target is one immutable copy and at least one that is isolated, then restore tests that prove both work.
What Is an Immutable Backup?
An immutable backup is a backup copy that cannot be changed, overwritten, or deleted by anyone during a defined retention period, usually through write-once-read-many (WORM) enforcement.
Immutability is a property of the storage or backup software layer, not of the network. The data remains reachable and readable, which is why restores can be fast. What the layer refuses are write, overwrite, and delete operations until the retention clock expires.
Cloud platforms document this clearly:
AWS: Amazon S3 Object Lock applies WORM protection to object versions. In governance mode, users cannot overwrite or delete a version unless they hold special permissions. In compliance mode, a protected version cannot be overwritten or deleted by any user, including the AWS account root user.
Microsoft Azure: Immutable storage for Azure Blob Storage supports time-based retention policies and legal holds. While a policy is in effect, blobs can be created and read but not modified or deleted. Time-based retention intervals range from 1 day to 146,000 days.
Azure Backup: immutable vaults block operations that could lead to loss of recovery points, and the setting can be locked so it becomes irreversible.
On-premises, the same idea appears as hardened Linux repositories, WORM-capable storage appliances, S3-compatible object storage with Object Lock, and WORM tape cartridges.
What Is an Air-Gapped Backup?
An air-gapped backup is a copy that has no standing connection to the systems it protects, so malware or an attacker on the production network has no path to it.
The formal definition in the NIST glossary, which mirrors RFC 4949, describes an interface between two systems where they are not physically connected and any logical connection is not automated, meaning data crosses only manually, under human control.
Two forms are in common use:
| Form | How isolation is achieved | Example |
| Physical air gap | Media is disconnected or stored offline | Ejected LTO tape in a vault |
| Logical air gap | Network, identity, and administrative separation instead of physical disconnection | A separately owned cloud vault with its own access controls |
Note that "logical air gap" is an industry term and is looser than the NIST definition above. AWS uses it as a product name: an AWS Backup logically air-gapped vault stores copies in a service-owned account, is automatically locked with Vault Lock in compliance mode, and encrypts with an AWS-owned key by default (a customer-managed key is optional).
Immutable vs Air-Gapped Backup: Comparison Table
| Dimension | Immutable backup | Air-gapped backup |
| Core question it answers | "Can the data be changed or deleted?" | "Can the data be reached?" |
| Enforced by | Storage/backup layer (WORM, object lock, locked vault) | Isolation (offline media, separate network or administrative domain) |
| Stays online? | Yes | No, or only briefly during a controlled transfer |
| Main threat addressed | Deletion or encryption of backups by an attacker with access, or by mistake | Attacker or malware being unable to find or touch the copy at all |
| Restore speed | Typically disk or object-storage speed | Often slower; physical media must be retrieved and mounted |
| Key weakness | Weak if the retention policy can be shortened or bypassed by a privileged account | Needs discipline; transfer jobs and operators create exposure; media can be lost or degrade |
| Operational overhead | Low to moderate; policy-driven | Moderate to high; process-driven |
| Typical implementations | S3 Object Lock, Azure immutable storage, hardened repositories, WORM tape | Offline tape, removable media, isolated vaults |
| Protects against bad data already backed up? | No | No |
Immutable Backup vs. Air-Gapped Backup: Cost, RPO, and RTO Comparison
Immutable backups usually restore faster and cost less to operate day to day, while air-gapped copies usually restore more slowly and cost more in process and media but give the strongest last-resort guarantee. Neither control changes RPO by itself.
| Dimension | Immutable Backup | Air-Gapped Backup |
| RTO | Usually lower. Data stays online on disk or object storage, so restores run at normal repository speed. | Can be higher, especially for tape or other offline media that must be retrieved, mounted and read before restore starts. Disk-based backups generally recover faster than tape (TechTarget). |
| RPO | Set by backup frequency. Immutability protects points after they are written; it does not make them more frequent. | Set by how often the isolated copy is synchronized or written. A copy made weekly has up to a week of exposure even if the primary backup runs hourly. |
| Storage cost | Locked data cannot be pruned early, so long retention increases capacity use until it expires. | Offline media, offsite storage, or a separate cloud vault can add media, transport, storage, and account costs. |
| Operational complexity | Centers on retention settings, permissions, lock modes and who may change them. | Centers on media rotation, isolation, access control, and restore drills. |
| Best use | Fast recovery, protection against deletion and tampering. | Last line of defense when everything reachable may be compromised. |
| Main risk to manage | A bypassable or unlocked retention policy. | An isolated copy that is stale or has never been restored. |
Why the Difference Matters: Backups Are a Target
CISA's #StopRansomware Guide recommends maintaining offline, encrypted backups of critical data and regularly testing their availability and integrity. It explains why: many ransomware variants try to find and then delete or encrypt accessible backups so restoration is impossible without paying.
The word "accessible" is the dividing line. Immutability makes accessible backups resistant to modification. An air gap makes backups inaccessible. They attack the same problem from two sides.
NIST's SP 800-209, Security Guidelines for Storage Infrastructure, covers this area at the storage level. It addresses data protection, isolation, restoration assurance, and encryption as security areas for storage infrastructure, which maps closely to the two controls compared here.
Do You Need Both? Decision Matrix
If the data is business-critical and ransomware or insider deletion is a realistic threat, yes. If budget or process capacity is limited, the table shows where to begin.
| Your situation | Recommended approach | Why |
| Small environment, limited admin time | Immutable primary repository first, then a periodic offline or isolated copy | Immutability fits inside existing backup jobs; isolation can be added on a schedule |
| Regulated data with retention mandates (e.g., financial records) | Immutable storage with locked, compliance-grade retention | Platform documentation cites WORM compliance use cases for regulated industries |
| Concern about compromised backup-admin credentials | Immutability with separated policy authority, plus an isolated copy in a different administrative domain | Separation of authority is the real protection |
| Large datasets with strict RTO | Immutable disk or object tier for fast restore, plus an isolated copy for worst-case recovery | Isolated media generally restores more slowly |
| Cold archive, rarely restored | WORM tape, ejected after write | Offline and write-once in one medium |
| Highly critical systems | Both, with scheduled restore tests from each | No single control covers every failure mode |
Checklist: Verify a Copy Is Really Protected
1. Retention lock: can anyone shorten retention or disable the lock? Who, and with what approval?
2. Separation of duties: is the policy owner different from the daily backup operator?
3. Isolation: if you call it air-gapped, can a domain admin in production reach it? Through what path?
4. Encryption: CISA recommends encrypted backups; confirm key access is also separated.
5. Integrity testing: restore from each protected copy on a schedule, not just the primary.
6. Retention vs detection: does the window exceed your realistic detection time?
7. Documentation: is the recovery runbook stored offline too (CISA recommends an offline copy of the plan)?
FAQ
Q1: Is cloud object storage with Object Lock the same as an air-gapped backup?
No. Object Lock is immutability. If the bucket is reachable with production credentials, it is not isolated. AWS offers a distinct logically air-gapped vault type that adds separate ownership and a compliance-mode lock; a plain bucket does not.
Q2: Can ransomware still affect an immutable repository?
It cannot alter or delete locked versions, but it can cause new backups to contain encrypted data if production is infected before a job runs. Earlier clean versions remain until retention expires, which is why retention length matters.
Q3: Does immutability protect against someone destroying the underlying hardware?
Immutability is enforced by a software or service layer. Events outside that layer, such as physical damage, a site disaster, or compromise below the enforcing layer, are not covered by the retention lock. That is one reason to keep an offsite or isolated copy. This depends on the specific platform and architecture.
Q4: Is a WORM tape both immutable and air-gapped?
A WORM cartridge is write-once, and once ejected and stored, it has no network connection. WORM capability was introduced with LTO-3 and carried into later generations. It can be both, but only while it is actually offline.
Q5: What retention period should I choose?
There is no universal number. Base it on your slowest realistic detection time, regulatory minimums, and storage cost. Test with short periods first, as AWS advises for Object Lock.
Q6: What does 3-2-1-1-0 add to 3-2-1?
It is a widely used extension of 3-2-1 that adds one copy that is immutable or air-gapped and a goal of zero errors verified by restore testing. See Vinchin's explanation. It is an industry convention rather than a formal standard.
Q7: Does immutability slow backups or raise storage use?
It can raise storage consumption, since locked data cannot be pruned early. Impact on backup chains depends on the product; for example, Vinchin notes jobs fall back to full when WORM is newly enabled on existing storage.
Q8: Can I get both without tape?
Often yes. Combine an immutable repository with a copy in a separate administrative domain, such as a separately owned cloud vault or an isolated site, and verify that no shared credential can reach both.
Conclusion
Choose controls by failure mode, not by label. Immutability protects data that can be reached; isolation protects data that cannot. Both depend on who controls the policy, how long you keep clean points, and whether you have restored from them recently. Layer them in proportion to what the data is worth, and treat restore testing as the control that verifies the rest.
