NAS backup for small businesses: prove you can resume work
NAS backup for small businesses: prove you can resume work
A NAS alone does not protect a small business from data loss. It centralises files; a backup preserves recoverable copies. The evidence a business owner needs is a restore test: recovering the right data, re-establishing access and completing a real business task within an acceptable time.
On Monday morning, the shared folder is unavailable. The disks were monitored and the copy jobs showed green. Yet nobody knows how to get the team working again. Storage capacity is no longer the issue. The problem is how long quotes, order preparation or client files remain out of reach.
This is an illustrative scenario, not a client case study. Before buying a NAS or repurposing an old computer, ask: what work must we be able to resume if this storage disappears?
Why are NAS storage, RAID and synchronisation not enough?
A NAS provides storage over a network. RAID combines disks and, depending on its configuration, can keep a service running through certain hardware failures. Synchronisation propagates changes between locations. None of these mechanisms, on its own, guarantees recovery of a clean version after deletion or an attack.
A deletion can be replicated. Files encrypted by ransomware can replace good copies. An account with excessive permissions may reach both the original data and the backups. Adding disks without separating failure risks can therefore create false confidence.
Our guide to turning an old PC into a NAS covers hardware and shared-storage uses. This article addresses a different decision: how to resume work when that storage is unavailable or no longer trustworthy.
What makes a backup useful for business recovery?
The 3-2-1 rule is a useful starting point: three copies of the data, on two types of storage media, with one copy off-site. Geography is not enough, however. An external copy that the same compromised account can delete remains exposed. Check access rights, retained versions and isolation as well.
In its backup guidance updated on 14 September 2026, Cybermalveillance.gouv.fr, France’s national cyber assistance service, recommends copies on different media, storage at another location, disconnecting backup media after use and regular testing. These measures address different risks; one does not replace the others.
An offline copy reduces exposure to an attack on the network. Immutability controls can prevent changes or deletion for a defined period, subject to configuration and limitations. Cloud backup can be part of the design, but you need to check what the service covers, who can delete copies and how recovery works.
The December 2023 backup guidance from ANSSI, France’s national cybersecurity agency, explicitly recommends offline backups and backup infrastructure independent of production directories. Ordinary cloud synchronisation does not demonstrate that independence.
How much data loss and downtime can you accept?
Before comparing products, leadership needs two recovery objectives. The recovery point objective, or RPO, describes the maximum acceptable data loss measured in time. The recovery time objective, or RTO, describes the target time to restore service. These guide backup frequency, recovery resources and budget; they do not prove the system meets either target.
For example, a business might accept re-entering yesterday’s changes to a quotation folder and resuming work within the day. A continuous order-processing operation might reject that same loss. These are framing examples, not recommended targets for every company.
Make the decision workflow by workflow. Can staff work temporarily without the main system? Can the latest orders be reconstructed? Who authorises the return to service? Without those answers, a promise of “faster backup” says little about the interruption it will resolve.
How do you test recovery without disrupting live work?
Start with a limited scope in a separate environment. The test must reach an actual business task: open a recovered folder with the right application, find the expected version and confirm that the right user can work without gaining access to unrelated files.
- Select a critical workflow. Preparing a quote from a shared client folder is one possible starting point.
- Define the failure. A deleted file, an unavailable NAS and a compromised administrator account expose different dependencies.
- Restore a known copy. Record its date, elapsed recovery time and missing components without overwriting live data.
- Get business-user acceptance. Does the document open? Are attachments present? Are permissions correct?
- Record the outcome. State whether the objective was met, who owns any correction and when the next test is due.
Recovering files does not necessarily restore the application that uses them. ANSSI also recommends including business application configurations and installation media in backups. If operations depend on an ERP, recovering the business system must cover those dependencies, not just exported records.
Recovery after a cyberattack requires additional checks. A backup may contain compromised elements. Restoration must be coordinated with incident response, use trusted sources and include appropriate verification. Do not rush to reconnect a copy to an attacked system.
Who owns recovery evidence in a small team?
A service provider can monitor backup jobs; the workflow owner must confirm that work can resume. Leadership accepts the recovery target and residual data loss. A provider may report that every backup job succeeded while staff still cannot open the recovered client folder. The workflow owner’s acceptance closes that gap.
Maintain a short recovery record: covered workflow, copy locations, emergency access arrangements, latest test, measured recovery time and unresolved limitations. Backup alerts inform that record but cannot replace the exercise. Reassess the design after significant changes in software, data volumes or the organisation.
Here, the Say Digital Framework means scoping one workflow, prototyping its recovery, obtaining business acceptance and then extending the design. Changes go through testing and controlled delivery; where software components are involved, CI/CD supports those checks. Success is measured by the work restored, not the number of automated jobs.
What should you settle before the next purchase?
- Which workflow stops if the NAS disappears?
- Which copy survives loss of the premises or compromise of the main account?
- Can you recover a version from before the incident?
- Can you recover applications, configurations, permissions and access arrangements?
- Has a business user actually accepted the latest restore test?
Check your ability to resume work. Say Digital can scope a critical workflow, examine its dependencies and organise a tested recovery before extending the setup. Start with the work you need to recover, then select the tools needed to meet the agreed requirements.
Sources
Sources checked on 15 October 2026. The decision guidance and illustrative examples are Say Digital’s synthesis, not a certification of your installation. Both primary references below are in French.
- Cybermalveillance.gouv.fr — Why and how to manage your backups. Updated 14 September 2026.
- ANSSI — Information system backups, Essentials collection, version 1.1, December 2023.
