Immutable Backups for Small Business: Object Lock, WORM, and What It Costs

This post contains affiliate links. If you purchase through our links we may earn a small commission at no extra cost to you.

A backup that ransomware can encrypt or delete isn’t much of a backup. Immutable backups — copies that literally cannot be altered or deleted for a set period, even by someone with admin credentials — close that gap. Here’s what object lock and WORM storage actually mean, what they cost on real cloud targets, and how to set this up as an operations task rather than a theoretical security concept.

What “immutable” actually means

Immutability isn’t a permissions setting you can override with the right login — it’s enforced at the storage layer itself. Once a file is written under an immutability policy, it genuinely cannot be modified or deleted until the retention period expires, full stop, even by an account with full admin rights on that storage. That’s the entire point: if an attacker compromises your admin credentials, they still can’t touch the immutable copies, because “compromise the account” doesn’t unlock “delete the backup” the way it does with ordinary storage permissions.

Object Lock — the mechanism behind most cloud immutability

Object Lock, available on S3-compatible object storage, is the technical feature that makes cloud immutable backups possible. You set a retention period on an object (or a bucket-wide default), and the storage provider enforces it at the infrastructure level — not your backup software, the provider’s own storage layer. Two modes matter: Governance mode allows a small number of specially-privileged users to override the lock in an emergency; Compliance mode doesn’t allow an override from anyone, including the account owner, until the retention period ends. For ransomware protection specifically, Compliance mode is the one that actually matters — Governance mode still has a door, even if it’s a small one.

WORM — the older, still-relevant term for the same idea

WORM (write once, read many) is the general industry term Object Lock implements — it predates cloud storage and originally described physical media (optical discs) that couldn’t be rewritten after the first write. Object Lock is WORM enforcement applied to cloud object storage. If a compliance requirement in your industry mentions WORM retention, Object Lock in Compliance mode is what satisfies it on modern cloud storage.

What it costs — real 2026 pricing on three providers

All three major S3-compatible providers support Object Lock at no extra charge for the feature itself — you pay standard storage pricing either way. Backblaze B2 runs $6.95/TB/month, with free egress up to 3x your stored volume monthly, then $0.01/GB beyond that. Wasabi runs $7.99/TB/month (up from $6.99 as of a July 2026 price increase), with free egress under a fair-use policy — though very high-download workloads risk a request to move to a different plan. AWS S3 Standard runs $23/TB/month, over three times Backblaze or Wasabi, with $0.09/GB egress after a modest free tier. For a small business backup use case — write regularly, rarely download at volume — Backblaze or Wasabi’s pricing model fits the actual usage pattern far better than S3’s.

NAS-side immutable snapshots — the on-prem equivalent

If part of your backup strategy stays on-prem, modern business NAS platforms (Synology, QNAP, TrueNAS) support their own immutable snapshot features, conceptually similar to Object Lock but enforced at the NAS’s own filesystem layer. This protects against a compromised admin account on your network the same way cloud Object Lock protects against a compromised cloud account — worth enabling on any NAS serving as a backup target, not just relying on the fact that it’s a separate device from your primary systems.

This is an operations task, not a checkbox

Turning on Object Lock or an immutable snapshot policy is a five-minute setting change. Actually getting the retention period right — long enough to outlast a ransomware dwell time and detection window, short enough that storage costs don’t spiral — takes more thought. A common baseline is 30-90 days of immutable retention for your most recent, most-relied-on backup set, with longer-term (non-immutable, cheaper) archival storage behind it for anything older. Match the retention window to how long it realistically takes your business to detect an incident, not an arbitrary round number.

Where this fits with your existing backup software

Most modern backup platforms — Veeam among them — have built-in support for writing to Object Lock-enabled S3-compatible targets, meaning you don’t need to change your backup software to add immutability, just point an existing backup job at an Object Lock bucket with the right retention policy set. Confirm your specific backup software’s documentation for exact setup steps, since the configuration path differs by vendor even though the underlying Object Lock mechanism is the same.

Immutable backups don’t replace the rest of your ransomware plan

Immutable backups solve one specific problem well: making sure your recovery data survives an attack that has your admin credentials. They don’t prevent the initial compromise, detect it faster, or handle the operational response once it happens. For the broader ransomware picture — prevention, detection, incident response — our sister site covers that ground in ransomware protection for small business and what to do before, during, and after a ransomware attack. This piece is about making sure the backup itself is one less thing an attacker can take from you.

Test the restore, not just the write

An immutable backup that writes successfully but was never tested for restore is still an unverified backup — immutability protects the data from an attacker, not from your own untested assumptions about whether it actually restores cleanly. Run a real restore test on a schedule, the same discipline that applies to any backup regardless of whether it’s immutable.

Recommended hardware and services

• Synology DS1522+ NAS — supports immutable snapshots as a local backup target
• Seagate IronWolf 8TB NAS drives — NAS-rated storage for a local immutable backup target
• CyberPower CP1500PFCLCD UPS — protects a NAS backup target from a dirty shutdown during a write

Object storage providers mentioned here — Backblaze B2, Wasabi, and AWS S3 — are referenced by name for pricing accuracy rather than as affiliate links.

Related SBITG topics

Backup fundamentals: small business backup solutions, Backblaze vs iDrive, how to test a backup restore. Storage: NAS vs cloud storage, best NAS for small business.

Key takeaways

• Immutable storage is enforced at the infrastructure layer — even a compromised admin account can’t modify or delete data under an active retention lock.
• Object Lock in Compliance mode (not Governance mode) is the setting that matters for ransomware protection specifically, since Compliance mode allows no override from anyone.
• 2026 pricing: Backblaze B2 $6.95/TB/mo, Wasabi $7.99/TB/mo, AWS S3 $23/TB/mo — all support Object Lock at no extra charge for the feature itself.
• Most backup software (Veeam and others) already supports writing to Object Lock targets — no software change needed, just proper configuration.
• Immutability protects your recovery data from an attacker; it doesn’t replace testing that the backup actually restores cleanly.

FAQ

Does Object Lock cost extra on top of regular storage? No — on Backblaze B2, Wasabi, and AWS S3, Object Lock is a feature you enable, not a separate paid tier. You pay standard per-TB storage pricing either way.

What’s the difference between Governance mode and Compliance mode? Governance mode allows specially-privileged users to override the lock in an emergency. Compliance mode allows no override from anyone, including the account owner, until the retention period expires — the stronger protection, and the one that matters for ransomware resilience.

How long should the immutable retention period be? A common baseline is 30-90 days for your most recent backup set — long enough to outlast typical ransomware dwell time and detection windows, short enough to keep storage costs reasonable. Match it to how long it realistically takes your business to detect an incident.