For a small business that would struggle to operate without its customer records, invoices and working files, using both online storage and a disconnected removable copy provides two different recovery paths. Cloud storage can suit a team that needs access across devices, provided its accounts and recovery options are protected; a removable drive can suit large local files or unreliable internet, but it needs secure storage and regular restore tests. The National Cyber Security Centre (NCSC) cautions that neither cloud nor on-premises backups are ransomware-resistant by default.
Start with the information that would be difficult to replace, then consider who needs to reach it and what could put every copy at risk.
If invoices, contacts and working documents sit mainly on one device, plan for its loss or failure. An online copy and a removable copy that is disconnected after use provide separate places from which to restore; the NCSC advises testing that essential information can actually be recovered.
Shared access makes account control part of the backup decision. Check who can administer or delete files, protect important accounts with passkeys or strong unique passwords and two-step verification where supported, and make sure staff know how to restore the files they need. The NCSC recommends these protections for important online accounts.
A portable copy needs protection as well as enough capacity. For UK organisations holding personal data, the Information Commissioner’s Office (ICO) says security measures should reflect the risk; it advises keeping external storage securely, away from the main workplace where possible, and encrypting it.
Consider it when: Staff need files across devices and the business has reliable internet access.
Trade-off: A compromised account or a recovery window that is too short can leave needed versions out of reach; the NCSC says cloud backups are not ransomware-resistant by default.
Consider it when: Large files are held locally, internet access is unreliable, or the business needs a disconnected copy.
Trade-off: Someone must disconnect and secure the drive; the NCSC warns that malware can affect storage left connected to an infected computer.
Consider it when: Losing either the main device or access to the online account would seriously disrupt operations.
Trade-off: Two destinations require more routine work: monitor backups, restrict account access, store the drive securely and test both recovery paths.
Whichever route you use, define what must be restored before selecting capacity, a service plan or a drive.
| Priority | What to check | Your needs |
|---|---|---|
| Recovery scope | List essential files, email, contacts and invoicing records. Check what the backup captures and restore a representative set; the NCSC advises regular restore testing. | I need more than a copy of one documents folder if other records are necessary to keep working. |
| Separate copies | Check where each copy is kept, whether an older version can be recovered, and whether a removable drive can be disconnected after backup. | A stolen computer, damaged workplace or compromised account should not put every copy in the same failure path. |
| Access protection | Review sharing and administrator controls, account sign-in protection, and encryption and secure storage for removable media. The NCSC recommends passkeys where available, or strong passwords with two-step verification. | Only authorised people should be able to reach or change our files, particularly when a copy contains customer information. |
| Capacity and retention | Size storage against the data being protected, expected growth and the number of versions to keep. Check the service plan’s recovery period rather than assuming files remain recoverable indefinitely. | I want enough room for the records we need to restore, including the older copies our recovery plan calls for. |
| Working setup | Check internet reliability for online backups and the computer, cable and interface needed for a drive. Test recovery on a device the business can use. | Our backup routine has to work with our actual computers, connections and file sizes—not just a stated drive speed. |
The NCSC says cloud and on-premises backups are not ransomware-resistant by default. Damaged or unwanted changes may also be copied, so access to an earlier recoverable version matters.
Check the exact plan’s version and deletion recovery, retention period and account controls. Keep another recovery path if losing access to that account would be highly disruptive.
According to the NCSC, malware on an infected computer can also affect a connected storage device. A drive that stays attached does not provide the same separation as one put away after use.
Complete the backup, check it has run, then disconnect and store the drive securely. The ICO advises keeping external storage away from the main workplace where possible.
A drive’s capacity says little about whether it contains the email, invoices, customer records and working files needed for recovery. Samsung UK also notes that stated portable-SSD performance depends on the host configuration.
Inventory the essential data and planned retained versions, then check capacity, connection compatibility and a practical restore procedure.
A copy is less useful if important records were omitted or staff cannot access them when needed. The NCSC advises regularly testing that backed-up information can be restored.
Restore a representative set of critical files periodically and record who can carry out the steps, including access to any required credentials.
These references illustrate different recovery and storage features; check the exact service plan or drive variant against your own backup routine.
Cloud file storage for organisations using Microsoft 365 and sharing files across users or devices.
Cloud file storage for teams already working with Google accounts and shared Drive files.
Cloud file storage for teams that may need to undo unwanted changes across a shared folder or account.
A removable-storage line to consider when a business needs a physical copy of local files.
These drives are options for keeping a removable copy of business files. They do not replace a decision about which records to back up, how many versions to retain or whether an additional online copy is needed.
No image available
A 2TB removable drive is an option for a separate copy of local business files. Check that your backup routine includes every essential record and can restore it; disconnect the drive after use and store it securely.
No image available
This 1TB USB 3.2 Gen 2 SSD offers a removable destination for files held locally. Samsung UK says stated transfer performance for this model depends on the host configuration; check your connection, protected data volume and restore process before relying on it.
No image available
The 1 TB T7 is another removable destination for a local-file backup. Its stated connection is USB 3.2 Gen 2; confirm that your devices can connect, set a routine for disconnecting the drive and test a restore of essential files.
No image available
This USB 3.2 Gen 2 SSD is a portable option if files need copying from compatible computers or mobile devices. Its title lists iPhone 15/16, PC and Mac compatibility and transfer speeds of up to 1050MB/s read and 1000MB/s write; check the connection and backup workflow on the devices you will actually use.
No image available
The 5TB portable hard drive is worth considering when the files and versions you plan to retain call for more space. Its name identifies a Mac-focused variant: confirm compatibility with every computer needed for backup and recovery, then test restoring the records that matter.
Start with the information needed to keep operating, such as customer contacts, email, invoicing records and essential documents. Record where each is stored, choose a routine that captures changes often enough for the business, and test restoring files; the NCSC advises daily or weekly copies of essential information and regular restore tests.
Cloud storage can be a workable route if it covers the required information and the business can protect the account and recover needed versions. The NCSC says cloud backups are not ransomware-resistant by default, so check retention, deletion recovery and account controls; consider a separate removable copy if losing cloud access would seriously disrupt operations.
Test it regularly, including the files and records needed to operate—not just whether a backup job reports success. The NCSC advises regular restore testing alongside daily or weekly backups of essential information; set a test routine that reflects how often your data and systems change.
Disconnect it when it is not being used for backup or restoration. The NCSC warns that viruses can affect storage connected to an infected computer; after making and checking a copy, put the drive somewhere secure.
Use passkeys where supported, or a strong unique password with two-step verification, as the NCSC advises for important online accounts. For a team, also check who can administer, share, change or delete the stored files and how access will be handled when someone leaves.