What Is WORM (Write Once, Read Many)?

WORM — Write Once, Read Many — is a data storage model in which information can be written a single time and then read back as often as needed, but never modified, overwritten, or deleted for the duration of a defined retention period. Once data is committed to WORM storage, it becomes permanent and tamper-proof, making it the foundation of trustworthy, verifiable records.

The term originated with optical media such as CD-R and specialized WORM optical discs, where the physical act of writing permanently altered the medium. Today, WORM is overwhelmingly software-defined: the same guarantee is enforced by disk, tape, and object storage systems through retention policies and cryptographic controls rather than physical limitations.

How WORM Storage Works

WORM behavior is enforced by the storage system itself, not by the application writing the data. When an object or file is written, a retention period is applied. Until that period expires, the storage platform rejects any request to change or remove the data — even from an administrator or root account. Many systems also support legal hold, which extends protection indefinitely regardless of the retention clock.

In modern object storage, WORM is most commonly implemented through S3 Object Lock, which offers two modes: Compliance mode, where no one — including the account owner — can delete or alter a locked object before its retention date, and Governance mode, which allows specifically privileged users to adjust locks when appropriate.

WORM vs. Immutability vs. Object Lock

These terms are related but not identical. Immutability is the broad property of data that cannot be changed. WORM is the storage model that delivers immutability by allowing a single write followed by many reads. S3 Object Lock is the specific API mechanism that applies WORM retention to individual objects in S3-compatible storage. In short: Object Lock is how you switch on WORM behavior, and WORM is how you achieve immutability.

Why WORM Matters

WORM storage serves two priorities that have converged in recent years:

Regulatory compliance. Many regulations require that certain records be retained in a non-rewriteable, non-erasable format. SEC Rule 17a-4, FINRA Rule 4511, and CFTC Rule 1.31 have historically mandated WORM for financial records, and similar retention requirements exist across healthcare and public-sector data. (The SEC's 2022 amendment to Rule 17a-4, effective January 2023, retained WORM as an option and added an audit-trail alternative.)

Cyber resilience. WORM has become a frontline defense against ransomware. Because attackers increasingly target backups, storing backup copies on immutable WORM storage ensures that even if production systems are compromised, a clean, unalterable recovery point survives. This is why immutable backups are now a standard requirement in modern data-protection strategies.

Common Use Cases

WORM storage underpins a range of scenarios where records must be provably unaltered:

• Regulated financial and trading records that must be retained in non-rewriteable form under SEC, FINRA, or CFTC rules.
• Healthcare and patient data retention subject to long-term integrity and privacy requirements.
• Legal and e-discovery archives where documents must be preserved exactly as filed.
• Audit logs and chain-of-custody evidence that need a tamper-proof record of events.
• Immutable backup targets — the fastest-growing use case — that protect organizations against ransomware and accidental or malicious deletion.

WORM and ARTESCA

Scality ARTESCA delivers WORM semantics through S3 Object Lock, so backup and archive data written to ARTESCA is immutable from the moment it lands. Retention is enforced at the storage layer and cannot be switched off by a compromised administrator account.

Security is built in rather than bolted on: architectural immutability, a hardened operating system, and end-to-end cyber-resilience controls surround every object, extending WORM protection across the entire data path.

ARTESCA is validated with the leading backup platforms — including Veeam, Commvault, and Rubrik — giving organizations a compliant, ransomware-resilient WORM storage target that installs on standard servers.

WORM FAQs

Is WORM the same as immutable storage?

Effectively, yes — WORM is the storage model that makes data immutable. "Immutable" describes the outcome; WORM describes the write-once, read-many mechanism that produces it.

Can WORM data ever be deleted?

Not before its retention period expires. Once the defined period ends, data can typically be deleted according to policy — unless a legal hold keeps it locked for longer.

Is WORM only for compliance?

No. While WORM began as a compliance requirement, its biggest growth driver today is cyber resilience: immutable WORM backups are a proven defense against ransomware.

How is WORM implemented in cloud and object storage?

Most commonly through S3 Object Lock, which applies WORM retention (in Compliance or Governance mode) to individual objects in S3-compatible storage such as Scality ARTESCA.