For a small business working from home, a combined arrangement is a sensible starting point: keep an off-site backup for recovery away from the workspace and a separate copy that is not permanently connected to the working device. A removable drive, network-attached storage (NAS) or cloud service can serve different parts of that arrangement; the choice depends on where you need to restore files, how many devices you protect and how you will keep the copies separate. Test restoration rather than relying on completed backup jobs alone.
The National Cyber Security Centre (NCSC) identifies emails, invoices, documents, contacts and customer information among the records a small organisation may need to back up. The right arrangement depends on how those records are used and where they must be recovered.
If you run the business from one home workspace, focus on restoring essential records and earlier file versions, not just making copies. The NCSC advises small organisations to test that backups can be restored.
If work spans a laptop, desktop or several users, consider how each device is backed up and how you would retrieve files away from home. A central NAS target or a cloud service may be relevant, but neither removes the need for a separate, protected copy.
If backup media containing customer or contact information leaves the workspace, check encryption, password handling and physical access. The Information Commissioner’s Office highlights encryption as protection for stored personal information if a device is lost or stolen.
Choose how you will recover essential records before deciding on a device or service. Then plan a second destination that will not be exposed alongside the working copy.
Consider it when: You can follow a routine of connecting the drive for backups and storing it separately afterwards.
Trade-off: A drive kept at home does not provide recovery away from the workspace. The NCSC warns against leaving the only backup device permanently connected.
Consider it when: Several devices need a central local backup target and someone can manage its backups and access.
Trade-off: A NAS that remains reachable on the network still needs a separately protected copy and a tested restore process.
Consider it when: You need automatic off-site copies or must recover files while away from the home workspace.
Trade-off: Recovery depends on account access and the service’s version and deletion controls; a cloud account alone is not an isolated offline copy.
| Concern | What to check | Who this matters to |
|---|---|---|
| Recoverability | Check how to restore essential records and earlier versions, and whether a separate copy remains protected if the working device is compromised. | If losing invoices or contacts would stop my work, I need to know I can retrieve a usable copy after an incident. Around 33% of consumers put recoverability first. |
| Off-site access | Check which devices and folders are covered and how you would restore files away from home. | When I work on a laptop away from home, I need a backup I can reach without the original computer. For around 27% of consumers, remote recovery is the primary concern. |
| Confidentiality | Check encryption for stored copies and who can access, change or delete them. | If I take customer records off-site, I want to limit who can read them if the device is lost. Protecting that information comes first for around 27% of consumers. |
| Capacity and routine | Measure the data to protect, then check space for planned versions and whether the backup schedule is manageable. | I need a process I can keep up with as my records grow, without running out of room for the versions I rely on. Around 13% of consumers prioritise capacity and routine. |
The NCSC warns that connected USB and network storage can be affected alongside the original data. One drive at home also gives you no separate off-site recovery route.
Disconnect removable media when it is not needed, store it securely and maintain another separately protected copy.
A job status does not show whether you can retrieve the records or earlier versions needed to resume work. The NCSC advises regular restore testing.
Test retrieval of essential documents, contacts, invoices and any business application data you have chosen to protect.
If a restore fails during an incident, work may be delayed while records are reconstructed.
The NCSC advises protecting cloud backups against compromised accounts and destructive changes. An off-site location alone does not settle who can change or remove a copy.
Check account permissions, multi-factor authentication, version recovery, deletion protections and retention before relying on a service.
Portable media can be lost or stolen. The Information Commissioner’s Office identifies encryption as a way to protect personal information stored on such devices.
Assess encryption, password or key handling and physical storage before moving a copy containing personal information.
Synology NAS systems may suit businesses that want a central local backup target with another destination for their copies.
Kingston IronKey removable storage is relevant when a portable backup needs protection against unauthorised access after physical loss.
Backblaze Business Computer Backup is a cloud-service option for businesses protecting Mac or Windows computers away from local storage hardware.
This NAS option is relevant if several devices need a central local target. Plan a separate backup destination before relying on it for business recovery.
No image available
For a home business needing a central target for files from several devices, this NAS is listed with backup destinations including cloud services, external drives and a remote NAS.
It is a 2-bay, diskless model, so plan for drives and check usable capacity against your records and retention needs.
Configure and test a separate copy; check the available version retention, encryption and access controls before relying on it for recovery.
No. The NCSC advises against leaving the backup device connected to the working device when it is not in use, because connected copies can be affected too. Disconnect removable media after backing up and keep another separately protected copy.
Restore representative business records regularly, rather than checking only whether a backup job completed. The NCSC advises small organisations to test backups; include the documents, contact records, invoices and application data you would need to resume work.
Encryption is a security measure to assess according to the personal information and risks involved, not a blanket rule asserted for every backup here. UK businesses handling personal information must keep it secure, and the Information Commissioner’s Office highlights encryption’s value if stored data or portable media is lost or stolen.
Check who can restore, alter or delete copies, whether earlier versions remain available and how you would recover without the original device. For a NAS, plan a separate protected destination; for cloud backup, review account security and version or deletion controls. The NCSC advises protecting backups from changes made through compromised devices or accounts.
Start by measuring the business data you intend to protect. Allow for the versions and retention period you need, expected growth and any additional local copy, then check the usable capacity of the chosen drive, NAS configuration or service plan.