Choose a backup route around the files and devices you need to restore, the reliability of your internet connection and how quickly work must resume. A cloud account is not automatically a recoverable backup, and a drive left connected is not an offline copy. For important business data, combining a protected online copy with a separately stored, disconnected copy can reduce reliance on either route alone.
If an incident could affect both a work device and its connected backups, you need a copy that remains separate and can be restored. The National Cyber Security Centre recommends keeping an offline or digitally disconnected backup.
You need to know which computers, servers or file shares are covered, whether jobs have run and how to restore each workload. Synology describes central backup options for specified device and workload types, subject to the software and appliance used.
You need a manageable way to copy the files required to keep operating, with enough capacity and a secure location separate from the main device. The National Cyber Security Centre describes a backup as a copy of important data stored in a separate safe location.
Start with what must survive an incident, then check whether each route covers your devices, data volume and restore needs. Removable storage, network-attached storage (NAS) and cloud services solve different parts of that task.
Consider it when: You need a local copy from one or a few compatible computers, particularly if uploading the backup set is impractical.
Trade-off: The drive needs sufficient usable capacity and a routine for disconnecting and storing it securely.
Consider it when: You have a defined, limited set of essential files that fits on the device.
Trade-off: Keeping a manual copy current takes attention, and a limited-capacity device may not hold a full-device backup or retained versions.
Consider it when: Several supported devices or workloads need centrally managed backups and local restore options.
Trade-off: NAS needs administration and an additional copy held off-site or offline; supported workloads vary by appliance and software version.
Consider it when: Your connection can reliably upload the selected data and you need an off-site copy.
Trade-off: Check what can actually be restored, how long versions remain available and how backup accounts are protected.
Consider it when: Losing access to one backup route would leave important business data at risk.
Trade-off: You must maintain both copies, keep the offline one disconnected and test restoration from each.
| Concern | What to check | Who this matters to |
|---|---|---|
| Recovery after an incident | Check that at least one copy can remain offline or digitally disconnected, and practise restoring the required files or device backup. | If an incident reaches my working files, I need a separate copy I can still restore; around 36% of consumers put recovery isolation first. |
| Coverage across devices | List every device and workload, then confirm supported operating-system versions, schedules, retention and restore methods. | With several work devices to protect, I need to see whether each one has backed up successfully; about 29% of consumers make managed coverage their primary concern. |
| Capacity and local recovery | Allow for protected data, growth and retained versions; compare usable capacity and check whether uploads and restores suit your connection. | When a large backup set would strain my connection, I need enough local capacity to restore what matters; roughly 21% of consumers prioritise capacity and local recovery. |
| Portable essential-file copy | Define the essential files, verify device compatibility and capacity, and plan how to protect and store the media separately. | If I only need a controlled copy of essential records, I want a portable routine I can keep current; around 14% of consumers put that simpler arrangement first. |
A connected drive may be affected by the same ransomware incident as the original data, as the National Cyber Security Centre warns.
Disconnect a removable backup when it is not in use, keep it in a separate secure location and test a restore rather than relying only on a completed-job notification.
Multiple devices, retained versions and full-device copies can require more room than a single copy of current documents.
Count the data you will protect and the history you intend to keep. For NAS, check usable capacity after any chosen redundancy arrangement.
Access to a backup account can also mean access to cloud-held copies. The National Cyber Security Centre recommends two-step verification for cloud-service accounts where available.
Use business-controlled accounts, limit administrator access and decide who can recover the account before relying on it for backups.
Where a business acts as a controller and a cloud provider processes personal data for it, the Information Commissioner’s Office says a written contract or other legal act is required.
Review the provider’s processing terms, sub-processors and the countries where data is stored, processed and managed before choosing the service.
A reference point for external-drive backups when you need a local copy and have checked compatibility with your work devices.
A reference point for centrally managed backup using a compatible NAS appliance.
A cloud computer-backup example for businesses comparing file-version retention.
No. Before relying on cloud storage as a backup, confirm which data is copied, how often, whether earlier versions can be restored and who controls the account. The National Cyber Security Centre also advises protecting cloud accounts and checking that the connection can support the backup.
Disconnect a removable backup drive when it is not being used for a backup. The National Cyber Security Centre warns that malware or ransomware can affect attached media, so store the disconnected copy securely and test that you can restore from it.
Choose a retention period long enough for your business to discover a deletion or damaged file and restore an earlier copy. Check the service’s rules for previous versions and deleted files; Backblaze, for example, documents a 30-day default version history for its computer-backup service.
Check that the business controls its administrator accounts, can limit access and knows how to recover account access. Enable two-step verification where available, as the National Cyber Security Centre recommends for cloud-service accounts.
If your business is a controller using a provider as a processor for personal data, the Information Commissioner’s Office says a written contract or other legal act must be in place. Check the provider’s processing terms and where the data will be stored, processed and managed.