What do cyber insurance forms mean by offline or immutable backups?

What exactly does the form ask?

These are the forms' own words, with the form and page each comes from.

Your backups are immutable.

Your backups are kept separate from your network (offline/air-gapped backup solution or cloud-based backup solution).

All system configuration and data back-ups are maintained in offline copies disconnected from the organization's network?

Please provide details on the number of backup copies you take, including details on how you prevent separate backup copies being impacted by the same event (if applicable):

What does it mean for a small firm?

Offline means disconnected: a drive unplugged and stored, or a copy your network cannot reach. Immutable means a copy that cannot be changed or deleted for a set time.

How do I answer it truthfully?

Describe each copy: where it is, whether your network can reach it, and whether it can be deleted. A drive that stays plugged into a server is not offline.

Can an outside reading check this?

An outside reading cannot see backups. Nothing inside your network, your devices or your accounts can be seen from outside, so this cannot be checked that way. Only your own settings and records can show it.

Which questions sit next to this one?

• Backup frequency
• MFA on backups
• Syncing services as backup