In this guide · 8 sections
- 01What a small business actually needs to back up
- 02Cloud backup vs NAS vs both
- 03Ransomware-proof backups: immutable and offline copies
- 04How long to keep backups: retention and IRAS records
- 05Test restores, or you do not have a backup
- 06Questions to ask a backup provider before you sign
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Most small businesses should use both: a NAS in the office for fast local restores and an off-site cloud copy that is immutable or offline, so ransomware cannot encrypt or delete it. Back up laptops, Microsoft 365 or Google Workspace, your website and accounting data, and test a restore every quarter.
What a small business actually needs to back up
Start with a list of where your data lives, not with a product. Many offices back up the file server carefully and forget that most work now sits in cloud mailboxes, laptops and online accounting.
| Data | Where it usually lives | Why it needs its own backup |
|---|---|---|
| Email, OneDrive, SharePoint, Google Drive | Microsoft 365 or Google Workspace | Built-in recovery windows are short; deleted users and files expire |
| Laptops and desktops | Local disks | Files saved outside synced folders are lost with the device |
| Shared files | NAS or file server | Main ransomware target in offices with a server |
| Website and online store | Hosting account | Hacks and failed updates; host backups may be kept only days |
| Accounting and payroll | Xero, QuickBooks or desktop software | 5-year record keeping; export copies if you change software |
| Line-of-business apps | Clinic, POS or booking systems | Check what the vendor backs up and for how long |
Cloud services protect you against their own hardware failures, not against your mistakes. Exchange Online keeps permanently deleted items for 14 days by default, and a Google Workspace admin can restore a deleted user for only 20 days, as explained in our guide to backing up Microsoft 365 and Google Workspace.
Cloud backup vs NAS vs both
The two approaches solve different problems. A NAS restores a 200 GB folder in minutes over the office network. A cloud copy survives fire, theft and an attacker who has taken over your office network.
NAS in the office
- Fast restores of large folders
- One-off hardware cost plus disks
- Can back up PCs, servers and cloud mailboxes
- Same building risk: fire, theft, ransomware on the network
Best for: Offices with a file server or large design, video or CAD files.
Cloud backup only
From US$6.95/TB/month storage (Backblaze B2, Oct 2026)
- Off-site by default
- No hardware to maintain
- Large restores limited by internet speed
- Monthly cost grows with data and retention
Best for: Small, fully cloud-based teams with little local data.
Both (recommended)
3-2-1- NAS for quick local restores
- Immutable cloud copy for disasters and ransomware
- Meets the 3-2-1 rule
- Two systems to monitor
Best for: Most offices of 5 to 50 people.
Synology's Active Backup for Business is a common example of NAS software that backs up Windows PCs and Macs, physical servers, file servers, virtual machines, Microsoft 365 and Google Workspace from one console. Cloud storage prices are from Backblaze's B2 pricing page, approximate, as of October 2026; Microsoft's own Microsoft 365 Backup lists US$0.15 per GB of protected content a month.
Ransomware-proof backups: immutable and offline copies
Modern ransomware looks for backups first. If your backup drive is mapped as a network drive, or the backup console uses the same admin password as everything else, the attacker deletes or encrypts the backups before encrypting your files.
- Immutable storage: the backup is locked for a set period (for example 30 days) and cannot be changed or deleted, even by an admin account. Many cloud storage services and NAS systems offer this as object lock or immutable snapshots.
- Offline copy: a disk that is disconnected and stored away between backups. Cheap and effective, but relies on someone rotating it.
- Separate credentials: the backup system has its own admin account with MFA, not linked to your normal Microsoft 365 or Windows admin.
CSA's Cyber Essentials mark has backup as one of its five areas, covering regular backups kept separately and restore testing. Our Cyber Essentials checklist lists the details.
How long to keep backups: retention and IRAS records
Backups have two jobs. Short-term versions (daily for 30 days, weekly for a few months) let you roll back a mistake or an attack. Long-term copies help you meet record-keeping rules.
IRAS's record keeping requirements say a company must keep source documents, accounting records and bank statements for at least 5 years from the relevant Year of Assessment. Electronic records are acceptable. Your accounting system and document folders are where those records live; the backup is your insurance if that system fails. Our guide to keeping business records for 5 years covers the filing side.
Do not keep everything forever by default. The PDPA requires you to stop keeping personal data once it is no longer needed for legal or business purposes, so set retention per data type rather than one infinite policy.
Test restores, or you do not have a backup
Backup software reports 'success' when it copied data, not when that data can be restored. Schedule restore tests and write down how long they took.
Restore a single file every month
Pick a random file from the NAS and from Microsoft 365 or Google Workspace. Restore it to a different location and open it.
Restore a full mailbox or folder each quarter
Choose a leaver's mailbox or a project folder and restore it to a test account. Note the time taken.
Rebuild one laptop a year from backup
A full machine restore shows whether bare-metal recovery works and how long staff would be without a device.
Restore the website to a staging copy
Hosting backups often miss the database or uploads folder. Check the restored site actually loads.
Record results and fix gaps
Keep a simple log: date, what was restored, time taken, problems found. Insurers and auditors may ask for it.
If the worst happens, our ransomware response guide explains the order of actions, including when to restore.
Questions to ask a backup provider before you sign
Whether you buy software, a managed backup service or both, these answers tell you whether the setup will hold up on a bad day.
Backup provider checklist
Do it yourself or get help?
A technically confident owner can set up a NAS with cloud replication, or a cloud-to-cloud backup for Microsoft 365, in a day or two. The parts that usually get skipped are immutability, separate admin credentials, failure alerts and restore tests.
Our Backup & Ransomware Recovery service (S$290) sets up the 3-2-1 plan for your office: local and immutable off-site copies, Microsoft 365 or Google Workspace backup, alerts and a first documented restore test.
Frequently asked questions
Not on its own. A NAS in the same office shares the same risks as your computers: fire, theft and ransomware spreading over the network. It is a good first copy for fast restores, but you also need an off-site copy, ideally immutable or offline, so a single incident cannot destroy both.
Raw cloud storage is cheap. Backblaze B2 listed US$6.95 per terabyte a month in October 2026, and Microsoft 365 Backup lists US$0.15 per GB of protected content a month. Backup software, licences per device or user and the setup work add to that, so compare total yearly cost, not storage alone.
For most businesses, yes. Both providers protect against their own hardware failures, but built-in recovery windows are short. Exchange Online keeps permanently deleted items for 14 days by default and Google Workspace deleted users can be restored for 20 days. A separate backup covers late-noticed deletions, ransomware and removed leaver accounts.
An immutable backup is locked for a set period so that nobody can change or delete it, including an attacker who has stolen an administrator password. Cloud storage object lock and NAS immutable snapshots are common ways to do it. It is the main protection against ransomware that targets backups first.
IRAS requires companies to keep source documents, accounting records and bank statements for at least 5 years from the relevant Year of Assessment, and GST records for at least 5 years from the end of the accounting period. Electronic records are accepted. Backups help protect those records but should not replace a proper filing system.