Backup Solutions for Small Business: What to Look For
Conrad Lunderstedt
What a small business needs to back up, image vs file backup, cloud vs local, immutability against ransomware, how backup is priced, and a buying checklist to use before you sign.
Updated: October 2026
A small business usually finds out how good its backup is on the worst day of the year. A laptop dies, a NAS gets encrypted, or someone empties a shared folder, and the only question left is how much comes back and how fast. This guide covers what to protect, how the main backup solutions for small business differ, and the checklist to use before you pay for one.
What a Small Business Needs to Back Up
Start with where the data lives, not with a product. In a typical small office that's four places.
Laptops and desktops hold drafts, downloads and the files nobody saved to the shared drive. A file server or NAS holds the shared folders. A line-of-business app, like accounting or practice management, keeps a database on a server or in its own cloud. And email, calendars and documents sit in Microsoft 365 or Google Workspace.
That last one catches people out. Sync and version history help with a single deleted file, but they aren't a separate copy. Delete or encrypt the file in one place, and sync faithfully repeats the damage everywhere. Microsoft now sells its own add-on, Microsoft 365 Backup, billed at $0.15 per GB per month (Microsoft Learn, updated August 2026). If the vendor charges for backup separately, the subscription alone isn't one.
Our Microsoft 365 backup guide covers what retention does and doesn't protect in more depth.
Image Backup vs File Backup
A file backup copies documents, folders and mailboxes. It's small, cheap to store and quick to search. When someone overwrites a spreadsheet, a file backup gets it back in a minute.
An image backup copies the whole disk: Windows, apps, settings and data. It's bigger, but it rebuilds a dead machine in one restore, often onto new hardware. For a server running an accounting database, that's the difference between an afternoon and three days of reinstalling.
A typical small business needs both. Image the servers and any PC that's painful to rebuild. File backup covers everything else, including the laptops that travel.
Cloud, Local or Both
Local backup, to a NAS or a USB drive, restores fast because the data is in the building. It also sits next to everything else that can burn, flood or get encrypted.
Cloud backup survives the office. It's slower to restore a full machine over the internet, and it depends on your connection on the day you need it.
The standard answer is the 3-2-1 rule: three copies of your data, on two different types of storage, with one copy offsite. For a small office that often means the live data, a local NAS copy and a cloud copy.
This r/cybersecurity thread asks the question almost word for word. The top reply warns that NAS defaults are "ransomware magnets" and that plain cloud sync just replicates encrypted files.
IBM Technology's walkthrough explains the 3-2-1 rule and why the offsite copy matters.
Immutability: The Copy Ransomware Can't Touch
Ransomware crews go after backups on purpose. If they can delete or encrypt your copies, you have no choice but to negotiate. Sophos' State of Ransomware 2026 found that 56% of attacks succeeded in encrypting data.
An immutable backup can't be changed or deleted until its retention period ends, even by an admin account. Cloud storage does this with object lock. Some backup appliances and services build it in. A USB drive you unplug and take home gives you a crude version for free. Our guide to immutable backups covers how the locks work and what they miss.
Ask every vendor one question: if an attacker gets my admin password, can they delete my backups? The only good answer is no, and the vendor should be able to explain why. For the wider picture of how these attacks unfold, see our guide to a ransomware attack.
Restore Speed Matters More Than Backup Speed
Nobody gets paid for a backup. You get paid for a restore. Two numbers decide whether a product fits.
The recovery point objective (RPO) is how much work you can afford to lose. Nightly backups mean up to a day of lost work. The recovery time objective (RTO) is how long you can be down. A cloud-only image restore over a slow connection can take a day or more for a full server.
Backup schedules shape both numbers. Our explainer on incremental vs differential backup walks through how each one changes restore time and storage.
Then test. Restore one file every month and one full machine every quarter. A backup that has never been restored is a guess. Our guide to disaster recovery testing has a simple test plan you can copy.
How Small Business Backup Is Priced
Vendors price backup in four common ways. Per device, usually split into workstations and servers. Per GB or TB stored. Per user, for Microsoft 365 or Google Workspace backup. Or as a hardware appliance with a subscription on top.
Per-device pricing is easy to budget when you have a handful of machines. Per-storage pricing rewards good retention settings and punishes keeping everything forever. Before you compare quotes, write down how many devices you have, how much data sits on the server and in the cloud suite, and how long you need to keep it.
Watch the extras: restore fees or egress charges, a separate licence for the cloud suite, and minimum terms. This r/smallbusiness thread shows the one-laptop end of the market, where a solo consultant weighs a cloud backup subscription against an external drive.
A Buying Checklist for Small Business Backup
Run every product through the same questions before you sign:
- Does it cover every place your data lives: PCs, the server or NAS, line-of-business data and Microsoft 365 or Google Workspace?
- Can it do both image and file backup, and restore to different hardware?
- Does it keep an offsite copy, and is that copy immutable?
- Can an attacker with your admin password delete backups? What stops them?
- How long does a full server restore take from the cloud copy, and can you get a local copy first?
- Does it alert someone when a job fails, and who reads that alert?
- How is it priced, and what do restores, extra storage and early exit cost?
- Can you test a restore without calling support?
If a vendor can't answer the fourth and fifth questions clearly, keep looking.
Who Should Run It
A backup product still needs an owner. Someone has to read the failure alerts, check retention and run the restore tests. In a small business that's usually an office manager with other jobs, which is why backup often ends up with an MSP.
If you work with an MSP, ask how they handle each item on the checklist above. Our guide to MSP backup solutions shows the questions from their side of the table.
Larger teams weighing appliances and enterprise platforms can read our enterprise backup guide.
The Short Version
Back up every place your data lives, including the cloud suite. Use image backup for servers and file backup for everything else. Keep three copies, one offsite and immutable, and test restores on a schedule. Then pick the product that answers the checklist, not the one with the longest feature list.
Conrad Lunderstedt
Solution Architect
I'm Conrad, Solution Architect at Flamingo. I've spent about 26 years in IT, roughly half of it inside MSPs and the rest in enterprise environments, so I've watched vendor decisions get made on both sides of that line. Now I spend my days talking with MSPs about the stack they already run, and helping them work through the requests and issues that come with it.