NAS Backup for a Small Business: The 3-2-1 Rule, Explained Simply

A NAS (Network Attached Storage) is often treated as the backup itself. It isn't — it's shared storage, and if it's the only copy of your data, a single device failure, fire, theft, or ransomware attack can wipe out everything at once. A real backup strategy needs more than one copy, in more than one place.

The 3-2-1 rule

3 copies of your data — the original plus two backups
2 different types of storage — for example, the NAS plus an external drive or cloud storage, not two copies on the same type of device
1 copy offsite or offline — somewhere physically separate from the office, or disconnected from the network, so it survives a local disaster or a ransomware attack that encrypts everything it can reach

Why "offline" matters more than people think

Ransomware specifically targets connected backups. If your NAS is always network-accessible, an infection that spreads through the office network can encrypt the live data and the backup sitting on the NAS at the same time. At least one backup copy needs to be either offline (disconnected) or offsite (a different physical location) to survive this.

What this looks like in practice

On a Synology NAS deployment, the setup included role-based, department-level access control — but access control and backup are two separate concerns. Access control decides who can reach the data day to day; backup decides what happens when something goes wrong regardless of who had access.

A reasonable small-business setup: NAS for daily shared storage, an automated backup job to a second NAS or external drive (different device), and a periodic (weekly or monthly) copy to cloud storage or a drive that's physically removed from the office.

The step everyone skips

A backup that's never been tested by actually restoring from it is a guess, not a plan. Pick a random file every few months and restore it from the backup — not from the live system — to confirm the backup actually works and isn't silently failing.