Should you back up to the cloud, keep local backups, or both? Here is a practical guide to choosing the right backup strategy for your business data.
When Melbourne businesses think about backup, they typically think in terms of “local” (an external drive or NAS in the office) or “cloud” (backing up to an offsite cloud service). In practice, the right answer for most businesses is neither one nor the other — it is both, implemented correctly.
But understanding what each approach provides — and where each fails — is essential for building a backup strategy that actually works when you need it.
Local Backup: Fast, Controllable, Vulnerable
Local backup stores copies of your data on hardware physically located in or near your office: an external hard drive, a NAS (Network Attached Storage) device, or a tape library.
Strengths
Speed: Restoring from local backup is fast. Recovering 1TB from a NAS on a gigabit local network takes minutes to hours. Recovering 1TB from cloud backup over a business NBN connection takes days.
No ongoing subscription cost: Once purchased, local backup hardware has no per-GB cost.
No internet dependency: Backup and restore operations work regardless of internet connectivity.
Compliance (data residency): Data stays on premises and does not transit or reside with a third-party cloud provider.
Weaknesses
Ransomware vulnerability: This is the critical weakness. If your local backup is a mapped network drive or a NAS accessible from the production network, ransomware will encrypt it along with your production data. A backup that is accessible from the network is not a safe backup in a ransomware scenario.
Physical disaster risk: Fire, flood, or theft destroys local backup along with production data. For Melbourne businesses in flood-risk areas (as the 2022 floods demonstrated), offsite copies are not optional.
No historical versioning without careful configuration: Many local backup solutions overwrite older backups. If ransomware has been silently encrypting files for days before detection, a local backup with short retention may only contain the encrypted versions.
Failure goes unnoticed: Local backup devices fail without alerts in many configurations. If nobody checks the backup logs, a months-long failure is discovered only when recovery is attempted.
Cloud Backup: Offsite, Ransomware-Resistant, Slow to Restore
Cloud backup sends copies of your data to an offsite cloud storage location — Microsoft Azure Backup, Veeam Cloud, Acronis Cloud, Backblaze, or similar services.
Strengths
Ransomware resistance: Quality cloud backup services offer immutable storage — backup data cannot be modified or deleted from the production network, even if an attacker gains access to the backed-up systems. This is the critical advantage over local backup in a ransomware scenario.
Offsite protection: Data is protected against physical disasters at the primary location.
Long retention with versioning: Cloud backup services typically retain multiple versions over extended periods — 90 days, 1 year, or longer — enabling recovery to a point before ransomware began encrypting files.
Alerting and monitoring: Quality cloud backup services generate alerts for failed jobs, storage thresholds, and anomalies.
Weaknesses
Restore speed: Recovering large volumes of data from cloud backup is constrained by your internet connection’s upload speed. Recovering 5TB over a standard business NBN connection can take several days.
Ongoing cost: Cloud storage costs accumulate — typically charged per GB stored and per GB of data transferred. For businesses with large data volumes, this becomes significant.
Internet dependency: Cloud backup requires internet connectivity. If your internet connection fails, backup jobs fail.
The 3-2-1-1-0 Rule: Why Both Are Better
The original 3-2-1 backup rule (3 copies, 2 media types, 1 offsite) has been updated for the ransomware era to 3-2-1-1-0:
- 3 copies of data (production + two backups)
- 2 different media types (e.g. NAS and cloud)
- 1 offsite copy
- 1 immutable or air-gapped copy (cannot be modified or deleted by production systems)
- 0 errors in backup jobs (all jobs monitored and verified)
The practical implementation for a Melbourne SMB:
- Production data on your servers, SharePoint, or primary systems
- Local backup to a NAS with air-gap capability (scheduled to disconnect from network after backup completes, or using object lock/immutability features)
- Cloud backup to an immutable cloud storage service
This strategy gives you fast local restore for day-to-day recovery needs, and a ransomware-resistant offsite copy for disaster scenarios.
Choosing the Right Cloud Backup Solution
For Microsoft 365 Data
Microsoft 365 (Exchange Online, SharePoint, OneDrive, Teams) has retention policies and a recycle bin — but these are not a backup in the traditional sense. Microsoft’s shared responsibility model places data backup responsibility on the customer.
Dedicated Microsoft 365 backup tools: Veeam Backup for Microsoft 365, Acronis Cyber Protect, Barracuda Backup for Microsoft 365. These take daily backups of mailboxes, SharePoint sites, and Teams data with point-in-time recovery.
For On-Premises Servers and VMs
Veeam Backup & Replication and Acronis Cyber Protect are the leading platforms for VM and physical server backup with cloud target support. Both offer immutable cloud targets.
Azure Backup is Microsoft’s native backup service — straightforward to configure for Azure-hosted VMs and on-premises Windows servers via the MARS agent.
For Cloud-First SMBs (Predominantly SaaS)
If your business runs primarily on SaaS applications (Microsoft 365, cloud-hosted accounting, cloud CRM), your backup needs are simpler:
- Microsoft 365 backup (as above)
- SaaS application backup through vendor-specific backup tools or the application’s own backup export
- Any remaining on-premises data backed up to cloud
Backup Testing: The Non-Negotiable Step
The most important thing about any backup strategy is that it has been tested. A backup that has never been restored is an assumption, not a fact.
Minimum testing schedule:
- Monthly: Restore a sample of files from each backup source and confirm they open correctly
- Quarterly: Restore an application or database to a test environment and confirm it functions
- Annually: Full recovery exercise — restore a complete system from backup and measure time against your RTO
CX IT Services designs, implements, and monitors backup solutions for Melbourne businesses — including immutable cloud backup and regular restore testing. Book a Right Fit Call to review your current backup posture.
