Filed under the NerdSquad IT Dictionary: the series where we decode the alphabet soup of IT. Today's term sounds like it belongs in a biology textbook, but it's actually one of the most important concepts in compliance, backup, and ransomware defense.
Write Once, Read Many.
That's it. That's the whole concept. You write the data one time, then you (and everyone else) can read it as many times as you want — but you can't edit it, overwrite it, or delete it. The data is locked in place for whatever retention period you set.
Think of it as the opposite of a Google Doc. A Google Doc is "write anytime, edit forever." WORM is "write once, then it's set in stone."
Imagine writing something in wet concrete. You've got one shot to get it right. Once it dries, that's it — your initials are there forever, and nobody can come along with a chisel and change the date without it being obvious.
WORM storage works the same way. The data goes in, it hardens, and it stays exactly as you wrote it for the entire retention period — whether that's seven years (financial records), six years (HIPAA), or "forever" (some legal archives).
If you've heard "worm" in a cybersecurity context, you might be thinking of the other worm — a type of self-replicating malware that spreads across networks. That's a completely different thing, just an unfortunate naming collision.
This article is about WORM storage. If you're trying to defend against worm malware, that falls under endpoint protection and zero-trust cybersecurity — a separate conversation.
WORM is one of those quiet, unsexy technologies that solves three loud problems at once:
A lot of businesses, and many of them don't realize it's a requirement until an auditor asks.
Here's where it gets practical. Modern WORM doesn't usually mean buying special "WORM hardware" (though that exists, mostly in tape libraries and optical media). It means using backup and storage platforms that support immutability flags — software-level locks that mimic the old hardware behavior.
When NerdSquad sets up secure backups, immutability is one of the levers we configure. You pick the retention window, we set the lock, and from that moment forward those backups are read-only — even to us.
Backups that can be deleted by an attacker aren't really backups. WORM is what turns "backup" into "backup we can actually rely on when things go sideways."
For most NerdSquad clients, WORM shows up as an immutability setting baked into their backup and compliance stack — not as a separate product they have to think about. We pair it with offsite copies, encryption, and regular restore testing, because immutable backups you've never tested are just a different kind of guess.
If you're in a regulated industry, we'll also document the retention policy in plain English so your compliance officer (or your auditor) doesn't have to take anyone's word for it.