Backups: Local NAS vs Cloud vs Immutable Storage vs Hybrid
On-site NAS, cloud backup, immutable storage or a hybrid 3-2-1-1-0 setup: ransomware resilience, restore speed, cost model and Canadian data residency compared.
Facts verified : October 2026This comparison is not sponsored.
Our recommendation for your situation
8-person Gatineau office, everything in Microsoft 365, no server
Cloud backup
With no local server, a NAS adds little. A cloud backup separate from Microsoft 365, with deletion protection and MFA on its admin account, covers the essentials.
40-person accounting firm in Montréal's West Island with a file server
Hybrid 3-2-1-1-0
The NAS quickly restores a deleted folder; the immutable cloud copy survives ransomware and disaster. Test restores regularly: the Canadian Centre for Cyber Security gives monthly testing as an example.
Business that already has a NAS and a cloud copy, both managed with the same credentials
Immutable storage
The biggest risk is one stolen account wiping out both copies. Turning on immutability for the cloud copy, with separate credentials and MFA, closes that door without starting over.
Side-by-side comparison
Criterion
Local NAS
Cloud backup
Immutable storage
Hybrid 3-2-1-1-0
Ransomware resilience
Low if the NAS is reachable with network accounts
Medium: depends on protected versions and access
High during the retention period
High: at least one offline or immutable copy
Can be erased with a stolen admin account
Yes
Yes, without deletion protection
Blocked during the retention period
Blocked for the immutable copy
Restore speed
Fast: the copy is on site
Limited by your internet connection
Depends on location: fast on site, limited by internet in the cloud
Fast for everyday incidents; cloud as a last resort
Off-site copy (fire, flood, theft)
No
Yes
Yes if it's in the cloud or at another site
Yes
Cost model
Device and drive purchase, then upkeep
Subscription by volume or number of users
Volume kept until retention ends, with no early purge
Local device plus cloud subscription
Data hosted in Canada
Yes, on your premises
Check: choose a Canadian region
Depends on the provider and region chosen
Local copy on your premises; cloud copy to check
Management effort
High: updates, separate accounts, rotating offline copies
Moderate: access, retention and alerts to monitor
Moderate: retention period to set in advance
Highest: two systems and regular tests
What the authorities say
Useful, never on its own: one copy must be off site
Recommended as a secondary backup (Canadian Centre for Cyber Security)
Recommended by the NCSC for cloud backups
Matches the Canadian Centre's 3-2-1 rule, strengthened
A local copy for speed, an off-site offline or immutable copy for survival, and restore tests with zero errors.
Best for
Any business with a server, or with data it can't afford to lose.
Pricing
Local device plus cloud subscription
Strengths
Fast everyday restores, plus a last-resort copy for ransomware or disaster
Applies and strengthens the Canadian Centre for Cyber Security's 3-2-1 rule
The Canadian Centre recommends a secondary cloud backup on top of offline copies
Limitations
Two systems to monitor
The combined cost of a device and a subscription
Requires regular, documented restore tests
Almost every small business has a backup. Far fewer have one that would survive ransomware. The Canadian Centre for Cyber Security puts it plainly: threat actors can attack NAS devices, and ransomware can spread to them. The UK NCSC adds that connected cloud backups have been compromised too.
So the real question isn't "NAS or cloud?" It's this: which copy will still be intact on the day an attacker holds your admin credentials? This comparison lines up four approaches, from the simplest to the most robust. For the rule itself, read our article on the 3-2-1-1-0 backup rule.
Our method
We compare approaches, not products. Every value in the table is based on publications from the Canadian Centre for Cyber Security, the UK NCSC, CISA and NIST, reviewed in October 2026.
Criteria: ransomware resilience, deletion with a stolen account, restore speed, off-site copy, cost, Canadian hosting, management effort and what the authorities recommend.
No prices are quoted: cost models are described qualitatively.
A NAS has one real advantage: speed. The Canadian Centre for Cyber Security notes that on-site storage is convenient, can save time and keeps backups readily available when you start a recovery. To restore a folder deleted by mistake or a failed server, nothing beats a copy on the local network.
Its two weaknesses are well known. First, it shares the fate of the building: a fire or flood takes out the original and the copy. Second, it's reachable from the network, often with the same admin accounts. An attacker who takes over the network finds the NAS and wipes it before launching encryption.
Cloud backup solves the disaster problem and the "someone forgot" problem: it's automatic and off site. The UK NCSC points out, however, that it needs a reliable internet connection both to back up and to restore. For a handful of files, that hardly matters; for a full server, the delay depends directly on data volume and your bandwidth.
On resilience, the cloud isn't magic. If an attacker can sign in to the console with a stolen account, they can delete the backups. The NCSC recommends checking that your cloud service protects previous versions from immediate deletion. Check the hosting region too: the Canadian Centre for Cyber Security reminds organizations that they remain legally responsible for their data, even with a provider.
Immutable storage, sometimes called object lock, prevents a backup from being changed or deleted during its retention period. It's the first of the NCSC's principles for ransomware-resistant cloud backups. The NCSC also recommends alerts on mass deletions or changes to retention settings, and an out-of-band way back into the service.
The trade-off: retention is set in advance. CISA advises using immutable storage with caution, since it doesn't meet the compliance criteria of certain regulations. Align the retention period with your policy for keeping and destroying personal information.
The hybrid approach combines the strengths of the others. The local copy handles everyday incidents; the off-site, offline or immutable copy is there for the day everything else is compromised. It extends the Canadian Centre's 3-2-1 rule: three copies, on two types of media, one of them off site. The Centre's ransomware playbook also recommends at least two offline backups and a secondary backup in the cloud.
The last digit, zero errors, is the one most often forgotten. A backup that's never been restored is just an assumption.
First, agree on two numbers with management: your recovery time objective (RTO), meaning how long you can operate without your systems, and your recovery point objective (RPO), meaning how many hours of work you can afford to lose. Then:
At least one copy is off site, and at least one is offline or immutable.
The backup admin account is separate from the network account and protected by MFA.
Backups are encrypted, and the key is stored elsewhere.
You know the hosting region, and a privacy impact assessment is done if it's outside Québec.
A full restore has been timed and compared with the RTO.
Not really. Sync replicates changes, including files encrypted by ransomware or deleted by mistake. The UK NCSC notes that ransomware incidents have compromised connected cloud storage containing backups. Version history offered by some services helps, but check how long versions are kept and who can delete them.
Does Québec's Law 25 require backups to stay in Québec?+
No. The law doesn't require hosting in Québec, but before personal information is communicated outside Québec, including to a provider that stores it for you, it requires a privacy impact assessment and a written agreement (s. 17). A cloud region in Ontario is therefore covered. Check your analysis with your legal counsel.
How long does a restore from the cloud take?+
It mostly depends on data volume and your internet connection: the UK NCSC points out that cloud backup needs a reliable connection both to back up and to restore. The only way to know your real figure is to time a full test restore, then compare it with your recovery time objective (RTO).
Should backups be encrypted?+
Yes. The Canadian Centre for Cyber Security's baseline controls call for backups to be stored in an encrypted state. Keep the key somewhere other than the backup itself: the UK NCSC suggests an out-of-band copy, such as a printed copy kept in a safe.