After a ransomware attack, the team finds S3 backups were reachable with the same admin credentials as prod — encrypted, but deletable. Object Lock Compliance promises immutability: even root cannot shorten retention. Only if you proved restore before trusting the lock.
Immutability without tested restore = vault without key. Cyber audit demands both: anti-extortion lock and quarterly timed exercise.
Object Lock vs versioning
S3 versioning allows delete marker — compromised admin can mark deleted. Object Lock Compliance refuses deletion before retention ends, even root account (except documented legal process).
| Mode | Override |
|---|---|
| Governance | Dedicated permission |
| Compliance | Refusal before retention |
Choose Compliance for contractual anti-ransomware copies.
Account architecture
Separate backup account from prod — stolen prod admin creds insufficient to wipe copies. Cross-account replication with prod-side read-only assumed role.
Documented break-glass: who, when, immutable log of break-glass access — never exercised except drill.
Immutable restore test
Quarterly: locked object copied to sandbox, timed, integrity verified. Failed restore tabletop > ten compliance slides.
Ransomware drill success metric: clean boot restore under documented RTO from immutable copy.
GDPR and legal hold
Immutable retention vs erasure rights conflict — legal hold vs erasure exception process with max contractual duration. Joint ops/legal review at cyber insurance renewal.
Legal hold tag overrides delete lifecycle — quarterly test on sample object.
Host choice
Verify Object Lock available on object storage offer — not all regions. Compare via directory and backup guides before signing.
Ransomware drill metric
Success = boot clean restore under documented RTO from immutable copy. Failure = update architecture or retention, not blame individual on-call.
Compliance mode Object Lock means even root account cannot shorten retention — verify legal agrees before enable.
Break-glass delete procedure documented and never exercised except drill — real ransomware is wrong time to read docs first time.
Operational follow-up
Review immutability at cyber insurance renewal — requirements evolve. Object Lock without separate account still vulnerable to stolen admin credentials — need both. Failed immutable restore tabletop worth more than ten compliance slides — schedule next quarter. Document gaps between host marketing and field measurement in the quarterly review.
Quarterly follow-up
Review immutability at cyber insurance renewal — requirements evolve. Object Lock without separate account still vulnerable to stolen admin credentials — need both. Failed immutable restore tabletop worth more than ten compliance slides — schedule next quarter. Document gaps between host marketing and field measurement in the quarterly review.
Immutable backup without tested restore is compliance theater — schedule drill before next board review.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Operational follow-through
Keep a dated runbook, quarterly review with business teams, and before/after metrics for each change. Document gaps between host marketing and field measurement: latency, quotas, restore, support. To compare infrastructure and read more field notes, browse our directory, comparison tool, and technical blog guides — a documented decision beats an upgrade bought in Friday night panic.
Quarterly review
Compare field metrics and host product sheet: latency, quotas, restore, support delays. Adjust contract or architecture on evidence, not feeling.
Cycle closure
Share the updated runbook with support and schedule the next drill on a shared calendar — institutional memory avoids repeating the same mistakes.
Deep dive backup-immutable
Keep before/after metrics for each change, the last successful drill date, and documented gaps between host marketing and field measurement. A quarterly review with business teams avoids repeating the same mistakes. To compare infrastructure and read more field notes, browse our directory, comparison tool, and technical blog guides.:::note Key takeaway. Immutable = anti-delete; separate account + restore drill = complete anti-ransomware. :::
Decide and move forward without blind spots
- Object Lock Compliance mode — prod and backup account delete must fail on locked object.
- Documented break-glass — who, when, immutable access log; no hidden omnipotent account.
- Cross-account replication — quarterly test, bucket separate from prod.
- Ops/legal review — immutable retention vs erasure rights, dated exception process.
- Cyber insurer file — dated policy screenshot for policy renewal.
Immutable offers: directory, comparison tool, backup blog.
Frequently asked questions
Immutability vs S3 versioning?
Versioning allows delete marker. Object Lock Compliance prevents deletion even by root — anti-ransomware lock.
Governance vs Compliance?
Governance allows override with dedicated permission. Compliance refuses deletion before retention.
Immutable restore test?
Quarterly: locked object to sandbox, timed, integrity verified. Immutability without tested restore = vault without key.
GDPR erasure conflict?
Document legal hold vs erasure exception process with max contractual duration.
Schedule the next immutable restore drill before board review — not after the incident.