Choose a backup route by where your business files live, how you would restore them and who can access the copies—not by capacity alone. A disconnected external drive can provide a local recovery copy, network-attached storage (NAS) can organise backups across several devices, and a cloud service can provide an off-site copy; combining separately protected routes may suit a business that cannot rely on a single recovery path. Each route still needs suitable access controls, retention and a tested restore process.
If invoices, customer records and working documents sit mainly on one or two devices, focus on keeping a separate, recoverable copy when a device is lost, stolen or fails. The National Cyber Security Centre advises small organisations to back up the data they need to operate.
When several computers or file shares need protection, a centrally managed schedule and a clear person responsible for checking restores may be more practical than separate manual routines. Check that the chosen system supports every workload you intend to back up.
If files live in online workspaces, check which accounts and files a separate backup covers, how long earlier versions remain available and who can authorise a restore. Access to the live workspace alone does not answer those recovery questions.
Start with the copy you could restore after an incident, then decide how to keep backups current and manageable. The National Cyber Security Centre warns that ransomware has affected connected USB and network backup storage, so a convenient backup connection should not be mistaken for isolation.
Consider it when: You need a local copy that can be disconnected after use, including when internet access is unreliable.
Trade-off: Someone must run and check the backup, store the drive securely and reconnect it for future copies.
Consider it when: Several supported devices or shared files need centrally administered backups.
Trade-off: The NAS needs configuration and maintenance, and a continuously reachable copy is not an isolated one.
Consider it when: Files are spread across laptops or locations and an off-site recovery copy matters.
Trade-off: Coverage, retained versions and restore access depend on the service and its account settings.
Consider it when: Losing operational files would seriously interrupt work and you need separate recovery paths.
Trade-off: Both copies need maintained schedules, permissions and restore tests.
| Concern | What to check | Who this matters to |
|---|---|---|
| Recoverability after an incident | Can a copy remain disconnected or otherwise protected from changes to the live files? Test restoring the files the business needs to resume work. | If ransomware reaches my working files, I need a separate copy that I can restore. Around 33% of consumers put recovery resilience first. |
| Regular backup with little manual work | Check automatic scheduling, coverage of the actual devices and folders, and how long changed or deleted versions remain available. | When daily work happens on my laptop, I do not want protection to depend on remembering a manual copy; around 27% of consumers prioritise a routine they can keep up. |
| Managing shared files and devices | List the PCs, Macs, servers and file shares involved, then confirm compatibility and restore methods for the exact system and software version. | With files spread across a small team, I need to know which devices are covered and who will manage recovery. Around 20% of consumers put shared administration first. |
| Personal-data access control | Check who can read, delete or restore copies, how administrator accounts are protected, and whether encryption suits the data and route. The Information Commissioner's Office calls for measures appropriate to the organisation's circumstances and processing risk. | If a backup holds customer or staff information, I need to control access as well as preserve the files; around 20% of consumers make personal-data protection their primary concern. |
The National Cyber Security Centre describes ransomware incidents that also affected connected USB and network backup storage. A backup can be present but unavailable when it is needed.
Keep a copy offline or digitally disconnected when it is not required, and test that you can restore from it.
Enough storage space does not establish that the system covers the business's computers, shared files or applications, or that staff can use its restore method.
Inventory the data and devices first. Confirm support for the exact workload and practise a restore before relying on the arrangement.
Backblaze documents a 30-day version-history setting for business groups, with one-year and forever options. The period you select affects which older files you can recover.
Check the selected service's retention settings and restore process against how long a deletion or unwanted change might go unnoticed.
For UK organisations processing personal data, the Information Commissioner's Office describes security measures appropriate to the circumstances and risk, including the ability to restore access and availability after an incident. A product feature alone cannot establish that the organisation's arrangements are appropriate.
Assess permissions, account security, retention and restore testing together, and assign responsibility for maintaining them.
A NAS and backup-software route for centrally managed copies of supported computers, servers and file shares.
A cloud endpoint-backup route for businesses protecting files held on computers.
A separate SaaS-backup route for organisations assessing protection for business data in supported online applications.
An external drive can provide a useful local copy, but relying on a permanently connected drive leaves that copy exposed to some of the same incidents as the computer. The National Cyber Security Centre advises small organisations to consider both online and storage-device backups; keep a removable copy secure, disconnect it when appropriate and test a restore.
Not necessarily: before relying on a cloud workspace for recovery, check what it retains after deletion or unwanted changes and whether a separate backup covers the files and accounts you use. Also check who can delete copies, how accounts are protected and how a restore would work.
The Information Commissioner's Office's UK data-security guidance does not prescribe a particular drive, NAS or cloud provider. Where backups contain personal data, it describes measures appropriate to the organisation's circumstances and processing risk, including timely restoration of access and availability after an incident. The ICO notes that this guidance is under review following changes made by the Data (Use and Access) Act.
Set and document a testing frequency that fits the files you must recover and the risks involved, rather than assuming one interval suits every business. The Information Commissioner's Office calls for appropriate processes to test security measures and improve them; a test should establish that the required data can actually be restored.
Confirm that the exact NAS, backup software and configuration support every device and workload you need, then test the intended restore method. For Synology Active Backup for Business specifically, Synology states that an x64 Synology NAS with Btrfs is required; a NAS that remains reachable from working devices also needs a separately protected recovery copy.