The question isn't cloud or local — it's both. The 3-2-1 rule has been the gold standard for backup strategy for two decades, and it still holds. Here's what it means in practice for a small business, with specific product combinations that cover all three layers without breaking the bank.
The 3-2-1 rule is simple: keep 3 copies of your data, on 2 different types of media, with 1 copy offsite. It's designed so that no single failure — hardware failure, fire, flood, ransomware — can destroy all your data at once.
In practice for an SMB: your working data on your computer (copy 1), an external drive or NAS at the office (copy 2), and cloud backup (copy 3, offsite). That's a complete 3-2-1 setup.
Backblaze Business Backup — unlimited cloud backup per userFrom $7/user/mo · Simple, set-and-forget · No data caps
Critical: A local backup drive that stays connected to your computer at all times is not a backup — it's a second copy that ransomware will encrypt simultaneously with your primary data. Disconnect it after each backup, or use a cloud backup for the always-on copy.
Ransomware has made the "which backup" question more urgent. Modern ransomware specifically looks for and encrypts backup destinations — it will encrypt your NAS, your connected USB drives, and any mapped network drives it can reach.
This means your backup strategy needs at least one copy that ransomware cannot reach:
Cloud backup (Backblaze) + occasional external drive kept offsite or at home. Low cost, low maintenance.
Cloud backup per device (Backblaze or IDrive Business) + a NAS with scheduled backups. NAS not always connected to internet.
Managed cloud backup with centralised console (IDrive Business) + local NAS + documented restore tests quarterly.
The most important thing: Test your restores. A backup you've never tested is a backup you don't have. Schedule a quarterly restore test — pick a random file from 30 days ago and restore it. If you can't, your backup isn't working.
For most SMBs, a cloud backup service running automatically on every device is the minimum viable setup. Add a local NAS or external drive for fast local recovery, but make sure that local copy is either disconnected or protected from ransomware. The combination costs less than most people think and covers almost every failure scenario.