For business-critical records, consider both an online backup and a separate offline copy: the National Cyber Security Centre (NCSC) advises small organisations to consider both routes and to disconnect removable storage when it is not in use. Cloud backup can serve staff working across locations, while an external drive remains useful when internet access is unreliable; either route still needs appropriate access controls, a suitable retention plan and a tested way to restore files.
If losing access to operational files would disrupt the business, focus on copies that are separated from the working system and on a restoration process you can test. NCSC guidance addresses offline or digitally disconnected backups alongside other backup locations.
When files change across staff computers and locations, check which devices and folders an automatic service actually covers and how staff would restore them. Backblaze describes automatic Mac and PC backup; the required coverage still depends on the service and the business’s devices.
An external storage device can form part of the plan when a reliable connection is unavailable, as the NCSC notes. It needs secure storage and a separate copy elsewhere so that one lost or failed device does not hold the only backup.
Choose the recovery arrangement before choosing a drive: decide which records and devices must be covered, then check whether each copy would remain accessible after the incident you are planning for.
Consider it when: Staff need backup and recovery across locations with reliable internet access.
Trade-off: An online copy can remain exposed through its accounts or connected backup access, so check permissions, recovery history and retention.
Consider it when: Internet access is unreliable or a physically separate local copy is needed.
Trade-off: The drive needs a backup routine, secure custody and disconnection outside backup windows; one drive is still one physical point of failure.
Consider it when: Critical records must not depend on one service, device or location for recovery.
Trade-off: Separate copies need their own access controls, maintenance and restoration tests to remain useful.
| Concern | What to check | Who this matters to |
|---|---|---|
| Recovery after a cyber incident | Check whether a copy is independent or disconnected, who can change or delete it, and whether restoration has been tested. | If an incident could make my operational records unavailable, I need a recovery copy that is not exposed in the same way as my working files. About 36% of consumers put this resilience need first. |
| Coverage across devices | List the devices and file locations to protect; check automatic coverage, restore options and version retention. | With files changing on several staff computers, I need backups that do not depend on everyone copying files manually. About 29% of consumers primarily need this coverage. |
| Local recovery | Allow for data growth and retained versions when sizing storage; check device compatibility and where the copy will be kept. | When internet access is unreliable, I need a local copy I can use without relying entirely on a cloud connection. About 21% of consumers put local recovery first. |
| Portable copy of essential files | Define the files to include, check usable capacity and choose appropriate encryption and secure storage. | If I only need to carry a defined set of essential records, I want that copy to be manageable and protected if the device is lost. About 14% of consumers primarily need this limited portable option. |
Files stored online may still be affected if connected backup locations or account access are compromised. Being able to see a file in the cloud does not, by itself, establish that an earlier usable copy can be restored.
Check who can alter or delete backups, use multi-factor authentication, review recovery history and retention, and keep a separate route for critical records.
The NCSC warns that viruses can affect storage devices connected to an infected computer. A drive left plugged in may therefore face the same incident as the files it protects.
Set a backup routine, disconnect the drive when it is not in use and store it securely. Keep another separated copy of important data.
Retained versions and additional protected devices can require more space than a single current copy. Synology’s Hyper Backup, for example, supports multiple versions with configurable rotation.
Work out which files or device images are included, allow for growth and decide how long restore points should remain available.
Without enough capacity, older restore points may have to be removed sooner than intended.
For personal data processed on a business’s behalf, the Information Commissioner’s Office (ICO) says a written controller–processor contract is required. The relevant terms and any international-transfer questions depend on the arrangement.
Review the provider’s processing terms, security responsibilities, sub-processors and deletion or return provisions before using it for customer or employee records.
Relevant to businesses already using Microsoft 365, OneDrive or SharePoint for working documents.
Relevant when backing up staff Mac and Windows computers is a central requirement.
Relevant to a business planning local or hybrid backups around compatible network-attached storage.
These Joybuy selections are portable drives for the local-copy part of a small-business backup plan. Choose capacity against the files and retained versions you intend to protect, and plan separately for secure storage, disconnection and another recovery copy.
Image unavailable
Consider this portable hard drive for a Mac-focused local backup when its capacity fits the files and versions you plan to retain.
5TB; for Mac; silver. Check compatibility with every computer that needs to create or restore a backup, along with the backup software’s retention and restore process.
Image unavailable
Consider this portable drive for a local copy when the protected data and planned retention fit within its capacity.
4TB; USB Type-C; USB 3.2 Gen 2x2; black. Check the computer’s connection and the backup software’s scheduling, version retention and restore options.
Image unavailable
Consider this portable SSD for a defined local backup set if 1TB accommodates the files and versions you need to keep.
USB 3.2 Gen 2; blue. Check device compatibility and how backups will be scheduled and restored; portable storage still needs secure custody.
Image unavailable
Consider this portable drive for a separate local copy when 2TB covers the business’s chosen data and retention needs.
USB Type-C; USB 3.2 Gen 2x2; black. Check host-device compatibility and the backup software’s scheduling and restore functions before relying on the copy.
Not necessarily. The NCSC says online storage can be used for backups where internet access is reliable, but advises considering an online copy alongside one on a storage device. Check account access, recovery history and whether a separate copy would remain available if the cloud account or connected files were affected.
Disconnect it when it is not being used for backup. The NCSC warns that viruses can affect storage devices connected to an infected computer and advises keeping the device securely when it is not in use.
Size it for the data being protected, expected growth and the versions or device images you intend to retain, rather than just one copy of today’s files. If your backup system rotates older versions, check when those restore points will be removed and test that the remaining ones meet your recovery needs.
Set a retention period that the business can justify for the data and its purpose. The ICO advises keeping personal data only for as long as needed; a particular law, contract or sector obligation may also affect specific records, so check those requirements before fixing the schedule.
Check the provider’s role, processing terms, security arrangements and where the data will flow. The ICO says a written controller–processor contract is required when a provider processes personal data on the business’s behalf; its guidance also provides a test for whether an arrangement involves a restricted international transfer.