[{"data":1,"prerenderedAt":397},["ShallowReactive",2],{"footer-services-en":3,"footer-local-en":28,"cmp-\u002Fen\u002Fcomparisons\u002Fbackup-nas-vs-cloud-vs-hybrid":45,"cmp-alt-\u002Fen\u002Fcomparisons\u002Fbackup-nas-vs-cloud-vs-hybrid":382,"cmp-others-\u002Fen\u002Fcomparisons\u002Fbackup-nas-vs-cloud-vs-hybrid":384},[4,8,12,16,20,24],{"path":5,"navTitle":6,"order":7},"\u002Fen\u002Fservices\u002Fcybersecurity-audit","Cybersecurity Audit",1,{"path":9,"navTitle":10,"order":11},"\u002Fen\u002Fservices\u002Fpenetration-testing","Penetration Testing",2,{"path":13,"navTitle":14,"order":15},"\u002Fen\u002Fservices\u002Fmicrosoft-365-google-workspace-audit","Microsoft 365 \u002F Google Workspace Audit",3,{"path":17,"navTitle":18,"order":19},"\u002Fen\u002Fservices\u002Flaw-25-compliance","Law 25 Compliance",4,{"path":21,"navTitle":22,"order":23},"\u002Fen\u002Fservices\u002Fremediation-hardening","Remediation and Hardening",5,{"path":25,"navTitle":26,"order":27},"\u002Fen\u002Fservices\u002Fongoing-security-partner","Ongoing Security Partner (vCISO)",6,[29,33,37,41],{"path":30,"city":31,"translationKey":32},"\u002Fen\u002Fcybersecurity-audit\u002Fmontreal","Montréal","montreal",{"path":34,"city":35,"translationKey":36},"\u002Fen\u002Fcybersecurity-audit\u002Flaval","Laval","laval",{"path":38,"city":39,"translationKey":40},"\u002Fen\u002Fcybersecurity-audit\u002Fsouth-shore","South Shore","rive-sud",{"path":42,"city":43,"translationKey":44},"\u002Fen\u002Fcybersecurity-audit\u002Fnorth-shore","North Shore","rive-nord",{"id":46,"title":47,"body":48,"criteria":205,"date":260,"description":261,"extension":262,"faq":263,"keyword":276,"meta":277,"navigation":144,"options":278,"path":334,"rawbody":335,"seo":336,"sources":337,"stem":367,"translationKey":368,"updated":369,"verdict":370,"verified":380,"__hash__":381},"comparisons_en\u002Fen\u002Fcomparisons\u002Fbackup-nas-vs-cloud-vs-hybrid.md","Backups: Local NAS vs Cloud vs Immutable Storage vs Hybrid",{"type":49,"value":50,"toc":197},"minimark",[51,55,64,85,90,93,96,100,103,106,110,113,116,120,123,126,130,133,176,193],[52,53,54],"p",{},"Almost every small business has a backup. Far fewer have one that would survive ransomware. The Canadian Centre for Cyber Security puts it plainly: threat actors can attack NAS devices, and ransomware can spread to them. The UK NCSC adds that connected cloud backups have been compromised too.",[52,56,57,58,63],{},"So the real question isn't \"NAS or cloud?\" It's this: which copy will still be intact on the day an attacker holds your admin credentials? This comparison lines up four approaches, from the simplest to the most robust. For the rule itself, read our article on the ",[59,60,62],"a",{"href":61},"\u002Fen\u002Fblog\u002F3-2-1-1-0-backup-rule-ransomware","3-2-1-1-0 backup rule",".",[65,66,69],"callout",{"title":67,"type":68},"Our method","info",[70,71,72,76,79,82],"ul",{},[73,74,75],"li",{},"We compare approaches, not products. Every value in the table is based on publications from the Canadian Centre for Cyber Security, the UK NCSC, CISA and NIST, reviewed in October 2026.",[73,77,78],{},"Criteria: ransomware resilience, deletion with a stolen account, restore speed, off-site copy, cost, Canadian hosting, management effort and what the authorities recommend.",[73,80,81],{},"No prices are quoted: cost models are described qualitatively.",[73,83,84],{},"This comparison is not sponsored.",[86,87,89],"h2",{"id":88},"the-nas-fast-but-within-the-attackers-reach","The NAS: fast, but within the attacker's reach",[52,91,92],{},"A NAS has one real advantage: speed. The Canadian Centre for Cyber Security notes that on-site storage is convenient, can save time and keeps backups readily available when you start a recovery. To restore a folder deleted by mistake or a failed server, nothing beats a copy on the local network.",[52,94,95],{},"Its two weaknesses are well known. First, it shares the fate of the building: a fire or flood takes out the original and the copy. Second, it's reachable from the network, often with the same admin accounts. An attacker who takes over the network finds the NAS and wipes it before launching encryption.",[86,97,99],{"id":98},"the-cloud-off-site-but-not-automatically-safe","The cloud: off site, but not automatically safe",[52,101,102],{},"Cloud backup solves the disaster problem and the \"someone forgot\" problem: it's automatic and off site. The UK NCSC points out, however, that it needs a reliable internet connection both to back up and to restore. For a handful of files, that hardly matters; for a full server, the delay depends directly on data volume and your bandwidth.",[52,104,105],{},"On resilience, the cloud isn't magic. If an attacker can sign in to the console with a stolen account, they can delete the backups. The NCSC recommends checking that your cloud service protects previous versions from immediate deletion. Check the hosting region too: the Canadian Centre for Cyber Security reminds organizations that they remain legally responsible for their data, even with a provider.",[86,107,109],{"id":108},"immutability-the-copy-nobody-can-erase","Immutability: the copy nobody can erase",[52,111,112],{},"Immutable storage, sometimes called object lock, prevents a backup from being changed or deleted during its retention period. It's the first of the NCSC's principles for ransomware-resistant cloud backups. The NCSC also recommends alerts on mass deletions or changes to retention settings, and an out-of-band way back into the service.",[52,114,115],{},"The trade-off: retention is set in advance. CISA advises using immutable storage with caution, since it doesn't meet the compliance criteria of certain regulations. Align the retention period with your policy for keeping and destroying personal information.",[86,117,119],{"id":118},"hybrid-3-2-1-1-0-speed-and-survival","Hybrid 3-2-1-1-0: speed and survival",[52,121,122],{},"The hybrid approach combines the strengths of the others. The local copy handles everyday incidents; the off-site, offline or immutable copy is there for the day everything else is compromised. It extends the Canadian Centre's 3-2-1 rule: three copies, on two types of media, one of them off site. The Centre's ransomware playbook also recommends at least two offline backups and a secondary backup in the cloud.",[52,124,125],{},"The last digit, zero errors, is the one most often forgotten. A backup that's never been restored is just an assumption.",[86,127,129],{"id":128},"how-to-choose","How to choose",[52,131,132],{},"First, agree on two numbers with management: your recovery time objective (RTO), meaning how long you can operate without your systems, and your recovery point objective (RPO), meaning how many hours of work you can afford to lose. Then:",[70,134,137,148,155,162,169],{"className":135},[136],"contains-task-list",[73,138,141,147],{"className":139},[140],"task-list-item",[142,143],"input",{"disabled":144,"type":145,"aria-label":146},true,"checkbox","At least one copy is off site, and at least one is offline or immutable."," At least one copy is off site, and at least one is offline or immutable.",[73,149,151,154],{"className":150},[140],[142,152],{"disabled":144,"type":145,"aria-label":153},"The backup admin account is separate from the network account and protected by MFA."," The backup admin account is separate from the network account and protected by MFA.",[73,156,158,161],{"className":157},[140],[142,159],{"disabled":144,"type":145,"aria-label":160},"Backups are encrypted, and the key is stored elsewhere."," Backups are encrypted, and the key is stored elsewhere.",[73,163,165,168],{"className":164},[140],[142,166],{"disabled":144,"type":145,"aria-label":167},"You know the hosting region, and a privacy impact assessment is done if it's outside Québec."," You know the hosting region, and a privacy impact assessment is done if it's outside Québec.",[73,170,172,175],{"className":171},[140],[142,173],{"disabled":144,"type":145,"aria-label":174},"A full restore has been timed and compared with the RTO."," A full restore has been timed and compared with the RTO.",[52,177,178,179,183,184,188,189,192],{},"On the day of an attack, these choices carry a lot of weight: see our guide to the ",[59,180,182],{"href":181},"\u002Fen\u002Fblog\u002Fransomware-first-24-hours","first 24 hours of a ransomware attack",". If your data is mostly in Microsoft 365, find out whether ",[59,185,187],{"href":186},"\u002Fen\u002Fblog\u002Fmicrosoft-365-backup-do-you-need-it","you need a separate Microsoft 365 backup",". Our ",[59,190,191],{"href":21},"remediation and hardening"," service reconfigures your backups and documents a test restore.",[194,195],"cta",{"variant":196},"devis",{"title":198,"searchDepth":11,"depth":15,"links":199},"",[200,201,202,203,204],{"id":88,"depth":11,"text":89},{"id":98,"depth":11,"text":99},{"id":108,"depth":11,"text":109},{"id":118,"depth":11,"text":119},{"id":128,"depth":11,"text":129},[206,213,220,227,232,239,246,253],{"label":207,"values":208},"Ransomware resilience",[209,210,211,212],"Low if the NAS is reachable with network accounts","Medium: depends on protected versions and access","High during the retention period","High: at least one offline or immutable copy",{"label":214,"values":215},"Can be erased with a stolen admin account",[216,217,218,219],"Yes","Yes, without deletion protection","Blocked during the retention period","Blocked for the immutable copy",{"label":221,"values":222},"Restore speed",[223,224,225,226],"Fast: the copy is on site","Limited by your internet connection","Depends on location: fast on site, limited by internet in the cloud","Fast for everyday incidents; cloud as a last resort",{"label":228,"values":229},"Off-site copy (fire, flood, theft)",[230,216,231,216],"No","Yes if it's in the cloud or at another site",{"label":233,"values":234},"Cost model",[235,236,237,238],"Device and drive purchase, then upkeep","Subscription by volume or number of users","Volume kept until retention ends, with no early purge","Local device plus cloud subscription",{"label":240,"values":241},"Data hosted in Canada",[242,243,244,245],"Yes, on your premises","Check: choose a Canadian region","Depends on the provider and region chosen","Local copy on your premises; cloud copy to check",{"label":247,"values":248},"Management effort",[249,250,251,252],"High: updates, separate accounts, rotating offline copies","Moderate: access, retention and alerts to monitor","Moderate: retention period to set in advance","Highest: two systems and regular tests",{"label":254,"values":255},"What the authorities say",[256,257,258,259],"Useful, never on its own: one copy must be off site","Recommended as a secondary backup (Canadian Centre for Cyber Security)","Recommended by the NCSC for cloud backups","Matches the Canadian Centre's 3-2-1 rule, strengthened","2026-10-24","On-site NAS, cloud backup, immutable storage or a hybrid 3-2-1-1-0 setup: ransomware resilience, restore speed, cost model and Canadian data residency compared.","md",[264,267,270,273],{"q":265,"a":266},"Is OneDrive or Dropbox sync a backup?","Not really. Sync replicates changes, including files encrypted by ransomware or deleted by mistake. The UK NCSC notes that ransomware incidents have compromised connected cloud storage containing backups. Version history offered by some services helps, but check how long versions are kept and who can delete them.",{"q":268,"a":269},"Does Québec's Law 25 require backups to stay in Québec?","No. The law doesn't require hosting in Québec, but before personal information is communicated outside Québec, including to a provider that stores it for you, it requires a privacy impact assessment and a written agreement (s. 17). A cloud region in Ontario is therefore covered. Check your analysis with your legal counsel.",{"q":271,"a":272},"How long does a restore from the cloud take?","It mostly depends on data volume and your internet connection: the UK NCSC points out that cloud backup needs a reliable connection both to back up and to restore. The only way to know your real figure is to time a full test restore, then compare it with your recovery time objective (RTO).",{"q":274,"a":275},"Should backups be encrypted?","Yes. The Canadian Centre for Cyber Security's baseline controls call for backups to be stored in an encrypted state. Keep the key somewhere other than the backup itself: the UK NCSC suggests an out-of-band copy, such as a printed copy kept in a safe.","NAS vs cloud backup",{},[279,293,307,321],{"name":280,"url":281,"tagline":282,"pricing":283,"bestFor":284,"pros":285,"cons":289},"Local NAS","https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Ftips-backing-your-information-itsap40002","A storage device on the office network that copies workstations and servers every night.","Purchase of the device and drives, then upkeep and eventual replacement","Fast, everyday restores: a deleted folder, a failed server.",[286,287,288],"Fast restores: the copy is on site","No dependence on your internet connection","Data stays on your premises",[290,291,292],"The Canadian Centre for Cyber Security warns that ransomware can spread to a NAS","Lost along with the premises in a fire or flood","Often managed with the same accounts as the rest of the network",{"name":294,"url":295,"tagline":296,"pricing":297,"bestFor":298,"pros":299,"cons":303},"Cloud backup","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fcollection\u002Ftop-tips-for-staying-secure-online\u002Falways-back-up-your-most-important-data","An automatic copy of your data with a provider, away from your premises.","Subscription based on storage volume or number of users","Businesses with no on-site server whose data already lives in Microsoft 365 or Google Workspace.",[300,301,302],"Off-site copy with no handling","Automatic backups make a recent copy more likely","Infrastructure managed by the provider",[304,305,306],"Restores are limited by your internet connection","The UK NCSC reports ransomware incidents that compromised connected cloud backups","Hosting region must be checked against your obligations",{"name":308,"url":309,"tagline":310,"pricing":311,"bestFor":312,"pros":313,"cons":317},"Immutable storage","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fguidance\u002Fprinciples-for-ransomware-resistant-cloud-backups","A copy, in the cloud or on a dedicated device, that can't be changed or deleted during its retention period (object lock).","An option offered by many backup and storage services; you pay for the volume kept until retention ends","Adding a copy that even a stolen admin account can't erase.",[314,315,316],"Withstands backup deletion, ransomware's first target","Recommended by the UK NCSC for cloud backups","Can be added to an existing backup without starting over",[318,319,320],"Retention period must be set in advance, with no going back","Replaces neither the local copy nor restore testing","CISA advises caution because it doesn't meet the compliance criteria of certain regulations",{"name":322,"url":323,"tagline":324,"pricing":238,"bestFor":325,"pros":326,"cons":330},"Hybrid 3-2-1-1-0","https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fransomware-playbook-itsm00099","A local copy for speed, an off-site offline or immutable copy for survival, and restore tests with zero errors.","Any business with a server, or with data it can't afford to lose.",[327,328,329],"Fast everyday restores, plus a last-resort copy for ransomware or disaster","Applies and strengthens the Canadian Centre for Cyber Security's 3-2-1 rule","The Canadian Centre recommends a secondary cloud backup on top of offline copies",[331,332,333],"Two systems to monitor","The combined cost of a device and a subscription","Requires regular, documented restore tests","\u002Fen\u002Fcomparisons\u002Fbackup-nas-vs-cloud-vs-hybrid","---\ntitle: \"Backups: Local NAS vs Cloud vs Immutable Storage vs Hybrid\"\ndescription: \"On-site NAS, cloud backup, immutable storage or a hybrid 3-2-1-1-0 setup: ransomware resilience, restore speed, cost model and Canadian data residency compared.\"\ndate: 2026-10-24\nverified: \"October 2026\"\ntranslationKey: ou-sauvegarder\nkeyword: \"NAS vs cloud backup\"\noptions:\n  - name: \"Local NAS\"\n    url: \"https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Ftips-backing-your-information-itsap40002\"\n    tagline: \"A storage device on the office network that copies workstations and servers every night.\"\n    pricing: \"Purchase of the device and drives, then upkeep and eventual replacement\"\n    bestFor: \"Fast, everyday restores: a deleted folder, a failed server.\"\n    pros: [\"Fast restores: the copy is on site\", \"No dependence on your internet connection\", \"Data stays on your premises\"]\n    cons: [\"The Canadian Centre for Cyber Security warns that ransomware can spread to a NAS\", \"Lost along with the premises in a fire or flood\", \"Often managed with the same accounts as the rest of the network\"]\n  - name: \"Cloud backup\"\n    url: \"https:\u002F\u002Fwww.ncsc.gov.uk\u002Fcollection\u002Ftop-tips-for-staying-secure-online\u002Falways-back-up-your-most-important-data\"\n    tagline: \"An automatic copy of your data with a provider, away from your premises.\"\n    pricing: \"Subscription based on storage volume or number of users\"\n    bestFor: \"Businesses with no on-site server whose data already lives in Microsoft 365 or Google Workspace.\"\n    pros: [\"Off-site copy with no handling\", \"Automatic backups make a recent copy more likely\", \"Infrastructure managed by the provider\"]\n    cons: [\"Restores are limited by your internet connection\", \"The UK NCSC reports ransomware incidents that compromised connected cloud backups\", \"Hosting region must be checked against your obligations\"]\n  - name: \"Immutable storage\"\n    url: \"https:\u002F\u002Fwww.ncsc.gov.uk\u002Fguidance\u002Fprinciples-for-ransomware-resistant-cloud-backups\"\n    tagline: \"A copy, in the cloud or on a dedicated device, that can't be changed or deleted during its retention period (object lock).\"\n    pricing: \"An option offered by many backup and storage services; you pay for the volume kept until retention ends\"\n    bestFor: \"Adding a copy that even a stolen admin account can't erase.\"\n    pros: [\"Withstands backup deletion, ransomware's first target\", \"Recommended by the UK NCSC for cloud backups\", \"Can be added to an existing backup without starting over\"]\n    cons: [\"Retention period must be set in advance, with no going back\", \"Replaces neither the local copy nor restore testing\", \"CISA advises caution because it doesn't meet the compliance criteria of certain regulations\"]\n  - name: \"Hybrid 3-2-1-1-0\"\n    url: \"https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fransomware-playbook-itsm00099\"\n    tagline: \"A local copy for speed, an off-site offline or immutable copy for survival, and restore tests with zero errors.\"\n    pricing: \"Local device plus cloud subscription\"\n    bestFor: \"Any business with a server, or with data it can't afford to lose.\"\n    pros: [\"Fast everyday restores, plus a last-resort copy for ransomware or disaster\", \"Applies and strengthens the Canadian Centre for Cyber Security's 3-2-1 rule\", \"The Canadian Centre recommends a secondary cloud backup on top of offline copies\"]\n    cons: [\"Two systems to monitor\", \"The combined cost of a device and a subscription\", \"Requires regular, documented restore tests\"]\ncriteria:\n  - label: \"Ransomware resilience\"\n    values: [\"Low if the NAS is reachable with network accounts\", \"Medium: depends on protected versions and access\", \"High during the retention period\", \"High: at least one offline or immutable copy\"]\n  - label: \"Can be erased with a stolen admin account\"\n    values: [\"Yes\", \"Yes, without deletion protection\", \"Blocked during the retention period\", \"Blocked for the immutable copy\"]\n  - label: \"Restore speed\"\n    values: [\"Fast: the copy is on site\", \"Limited by your internet connection\", \"Depends on location: fast on site, limited by internet in the cloud\", \"Fast for everyday incidents; cloud as a last resort\"]\n  - label: \"Off-site copy (fire, flood, theft)\"\n    values: [\"No\", \"Yes\", \"Yes if it's in the cloud or at another site\", \"Yes\"]\n  - label: \"Cost model\"\n    values: [\"Device and drive purchase, then upkeep\", \"Subscription by volume or number of users\", \"Volume kept until retention ends, with no early purge\", \"Local device plus cloud subscription\"]\n  - label: \"Data hosted in Canada\"\n    values: [\"Yes, on your premises\", \"Check: choose a Canadian region\", \"Depends on the provider and region chosen\", \"Local copy on your premises; cloud copy to check\"]\n  - label: \"Management effort\"\n    values: [\"High: updates, separate accounts, rotating offline copies\", \"Moderate: access, retention and alerts to monitor\", \"Moderate: retention period to set in advance\", \"Highest: two systems and regular tests\"]\n  - label: \"What the authorities say\"\n    values: [\"Useful, never on its own: one copy must be off site\", \"Recommended as a secondary backup (Canadian Centre for Cyber Security)\", \"Recommended by the NCSC for cloud backups\", \"Matches the Canadian Centre's 3-2-1 rule, strengthened\"]\nverdict:\n  - profile: \"8-person Gatineau office, everything in Microsoft 365, no server\"\n    pick: \"Cloud backup\"\n    why: \"With no local server, a NAS adds little. A cloud backup separate from Microsoft 365, with deletion protection and MFA on its admin account, covers the essentials.\"\n  - profile: \"40-person accounting firm in Montréal's West Island with a file server\"\n    pick: \"Hybrid 3-2-1-1-0\"\n    why: \"The NAS quickly restores a deleted folder; the immutable cloud copy survives ransomware and disaster. Test restores regularly: the Canadian Centre for Cyber Security gives monthly testing as an example.\"\n  - profile: \"Business that already has a NAS and a cloud copy, both managed with the same credentials\"\n    pick: \"Immutable storage\"\n    why: \"The biggest risk is one stolen account wiping out both copies. Turning on immutability for the cloud copy, with separate credentials and MFA, closes that door without starting over.\"\nfaq:\n  - q: \"Is OneDrive or Dropbox sync a backup?\"\n    a: \"Not really. Sync replicates changes, including files encrypted by ransomware or deleted by mistake. The UK NCSC notes that ransomware incidents have compromised connected cloud storage containing backups. Version history offered by some services helps, but check how long versions are kept and who can delete them.\"\n  - q: \"Does Québec's Law 25 require backups to stay in Québec?\"\n    a: \"No. The law doesn't require hosting in Québec, but before personal information is communicated outside Québec, including to a provider that stores it for you, it requires a privacy impact assessment and a written agreement (s. 17). A cloud region in Ontario is therefore covered. Check your analysis with your legal counsel.\"\n  - q: \"How long does a restore from the cloud take?\"\n    a: \"It mostly depends on data volume and your internet connection: the UK NCSC points out that cloud backup needs a reliable connection both to back up and to restore. The only way to know your real figure is to time a full test restore, then compare it with your recovery time objective (RTO).\"\n  - q: \"Should backups be encrypted?\"\n    a: \"Yes. The Canadian Centre for Cyber Security's baseline controls call for backups to be stored in an encrypted state. Keep the key somewhere other than the backup itself: the UK NCSC suggests an out-of-band copy, such as a printed copy kept in a safe.\"\nsources:\n  - title: \"Canadian Centre for Cyber Security: Tips for backing up your information (ITSAP.40.002)\"\n    url: \"https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Ftips-backing-your-information-itsap40002\"\n  - title: \"Canadian Centre for Cyber Security: Ransomware playbook (ITSM.00.099)\"\n    url: \"https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fransomware-playbook-itsm00099\"\n  - title: \"Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations\"\n    url: \"https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fbaseline-cyber-security-controls-small-and-medium-organizations\"\n  - title: \"Canadian Centre for Cyber Security: Developing your IT recovery plan (ITSAP.40.004)\"\n    url: \"https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fdeveloping-your-it-recovery-plan-itsap40004\"\n  - title: \"UK NCSC: Principles for ransomware-resistant cloud backups\"\n    url: \"https:\u002F\u002Fwww.ncsc.gov.uk\u002Fguidance\u002Fprinciples-for-ransomware-resistant-cloud-backups\"\n  - title: \"UK NCSC: Offline backups in an online world\"\n    url: \"https:\u002F\u002Fwww.ncsc.gov.uk\u002Fblog-post\u002Foffline-backups-in-an-online-world\"\n  - title: \"UK NCSC: Always back up your most important data\"\n    url: \"https:\u002F\u002Fwww.ncsc.gov.uk\u002Fcollection\u002Ftop-tips-for-staying-secure-online\u002Falways-back-up-your-most-important-data\"\n  - title: \"UK NCSC: Mitigating malware and ransomware attacks\"\n    url: \"https:\u002F\u002Fwww.ncsc.gov.uk\u002Fguidance\u002Fmitigating-malware-and-ransomware-attacks\"\n  - title: \"CISA: #StopRansomware Guide\"\n    url: \"https:\u002F\u002Fwww.cisa.gov\u002Fstopransomware\u002Fransomware-guide\"\n  - title: \"NIST: recovery time objective (RTO) definition, SP 800-34 Rev. 1\"\n    url: \"https:\u002F\u002Fcsrc.nist.gov\u002Fglossary\u002Fterm\u002Frecovery_time_objective\"\n  - title: \"LégisQuébec: Act respecting the protection of personal information in the private sector (P-39.1), s. 17\"\n    url: \"https:\u002F\u002Fwww.legisquebec.gouv.qc.ca\u002Fen\u002Fdocument\u002Fcs\u002FP-39.1\"\n---\n\nAlmost every small business has a backup. Far fewer have one that would survive ransomware. The Canadian Centre for Cyber Security puts it plainly: threat actors can attack NAS devices, and ransomware can spread to them. The UK NCSC adds that connected cloud backups have been compromised too.\n\nSo the real question isn't \"NAS or cloud?\" It's this: which copy will still be intact on the day an attacker holds your admin credentials? This comparison lines up four approaches, from the simplest to the most robust. For the rule itself, read our article on the [3-2-1-1-0 backup rule](\u002Fen\u002Fblog\u002F3-2-1-1-0-backup-rule-ransomware).\n\n::callout{type=\"info\" title=\"Our method\"}\n- We compare approaches, not products. Every value in the table is based on publications from the Canadian Centre for Cyber Security, the UK NCSC, CISA and NIST, reviewed in October 2026.\n- Criteria: ransomware resilience, deletion with a stolen account, restore speed, off-site copy, cost, Canadian hosting, management effort and what the authorities recommend.\n- No prices are quoted: cost models are described qualitatively.\n- This comparison is not sponsored.\n::\n\n## The NAS: fast, but within the attacker's reach\n\nA NAS has one real advantage: speed. The Canadian Centre for Cyber Security notes that on-site storage is convenient, can save time and keeps backups readily available when you start a recovery. To restore a folder deleted by mistake or a failed server, nothing beats a copy on the local network.\n\nIts two weaknesses are well known. First, it shares the fate of the building: a fire or flood takes out the original and the copy. Second, it's reachable from the network, often with the same admin accounts. An attacker who takes over the network finds the NAS and wipes it before launching encryption.\n\n## The cloud: off site, but not automatically safe\n\nCloud backup solves the disaster problem and the \"someone forgot\" problem: it's automatic and off site. The UK NCSC points out, however, that it needs a reliable internet connection both to back up and to restore. For a handful of files, that hardly matters; for a full server, the delay depends directly on data volume and your bandwidth.\n\nOn resilience, the cloud isn't magic. If an attacker can sign in to the console with a stolen account, they can delete the backups. The NCSC recommends checking that your cloud service protects previous versions from immediate deletion. Check the hosting region too: the Canadian Centre for Cyber Security reminds organizations that they remain legally responsible for their data, even with a provider.\n\n## Immutability: the copy nobody can erase\n\nImmutable storage, sometimes called object lock, prevents a backup from being changed or deleted during its retention period. It's the first of the NCSC's principles for ransomware-resistant cloud backups. The NCSC also recommends alerts on mass deletions or changes to retention settings, and an out-of-band way back into the service.\n\nThe trade-off: retention is set in advance. CISA advises using immutable storage with caution, since it doesn't meet the compliance criteria of certain regulations. Align the retention period with your policy for keeping and destroying personal information.\n\n## Hybrid 3-2-1-1-0: speed and survival\n\nThe hybrid approach combines the strengths of the others. The local copy handles everyday incidents; the off-site, offline or immutable copy is there for the day everything else is compromised. It extends the Canadian Centre's 3-2-1 rule: three copies, on two types of media, one of them off site. The Centre's ransomware playbook also recommends at least two offline backups and a secondary backup in the cloud.\n\nThe last digit, zero errors, is the one most often forgotten. A backup that's never been restored is just an assumption.\n\n## How to choose\n\nFirst, agree on two numbers with management: your recovery time objective (RTO), meaning how long you can operate without your systems, and your recovery point objective (RPO), meaning how many hours of work you can afford to lose. Then:\n\n- [ ] At least one copy is off site, and at least one is offline or immutable.\n- [ ] The backup admin account is separate from the network account and protected by MFA.\n- [ ] Backups are encrypted, and the key is stored elsewhere.\n- [ ] You know the hosting region, and a privacy impact assessment is done if it's outside Québec.\n- [ ] A full restore has been timed and compared with the RTO.\n\nOn the day of an attack, these choices carry a lot of weight: see our guide to the [first 24 hours of a ransomware attack](\u002Fen\u002Fblog\u002Fransomware-first-24-hours). If your data is mostly in Microsoft 365, find out whether [you need a separate Microsoft 365 backup](\u002Fen\u002Fblog\u002Fmicrosoft-365-backup-do-you-need-it). Our [remediation and hardening](\u002Fen\u002Fservices\u002Fremediation-hardening) service reconfigures your backups and documents a test restore.\n\n::cta{variant=\"devis\"}\n::\n",{"title":47,"description":261},[338,340,342,345,348,350,353,355,358,361,364],{"title":339,"url":281},"Canadian Centre for Cyber Security: Tips for backing up your information (ITSAP.40.002)",{"title":341,"url":323},"Canadian Centre for Cyber Security: Ransomware playbook (ITSM.00.099)",{"title":343,"url":344},"Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations","https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fbaseline-cyber-security-controls-small-and-medium-organizations",{"title":346,"url":347},"Canadian Centre for Cyber Security: Developing your IT recovery plan (ITSAP.40.004)","https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fdeveloping-your-it-recovery-plan-itsap40004",{"title":349,"url":309},"UK NCSC: Principles for ransomware-resistant cloud backups",{"title":351,"url":352},"UK NCSC: Offline backups in an online world","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fblog-post\u002Foffline-backups-in-an-online-world",{"title":354,"url":295},"UK NCSC: Always back up your most important data",{"title":356,"url":357},"UK NCSC: Mitigating malware and ransomware attacks","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fguidance\u002Fmitigating-malware-and-ransomware-attacks",{"title":359,"url":360},"CISA: #StopRansomware Guide","https:\u002F\u002Fwww.cisa.gov\u002Fstopransomware\u002Fransomware-guide",{"title":362,"url":363},"NIST: recovery time objective (RTO) definition, SP 800-34 Rev. 1","https:\u002F\u002Fcsrc.nist.gov\u002Fglossary\u002Fterm\u002Frecovery_time_objective",{"title":365,"url":366},"LégisQuébec: Act respecting the protection of personal information in the private sector (P-39.1), s. 17","https:\u002F\u002Fwww.legisquebec.gouv.qc.ca\u002Fen\u002Fdocument\u002Fcs\u002FP-39.1","en\u002Fcomparisons\u002Fbackup-nas-vs-cloud-vs-hybrid","ou-sauvegarder",null,[371,374,377],{"profile":372,"pick":294,"why":373},"8-person Gatineau office, everything in Microsoft 365, no server","With no local server, a NAS adds little. A cloud backup separate from Microsoft 365, with deletion protection and MFA on its admin account, covers the essentials.",{"profile":375,"pick":322,"why":376},"40-person accounting firm in Montréal's West Island with a file server","The NAS quickly restores a deleted folder; the immutable cloud copy survives ransomware and disaster. Test restores regularly: the Canadian Centre for Cyber Security gives monthly testing as an example.",{"profile":378,"pick":308,"why":379},"Business that already has a NAS and a cloud copy, both managed with the same credentials","The biggest risk is one stolen account wiping out both copies. Turning on immutability for the cloud copy, with separate credentials and MFA, closes that door without starting over.","October 2026","IlZIPlqWekdvk10dthM_eJX5yJsHpWESX960iSmQm7Y",{"path":383},"\u002Fcomparatifs\u002Fsauvegarde-nas-nuage-hybride",[385,389,393],{"path":386,"title":387,"description":388},"\u002Fen\u002Fcomparisons\u002Fantivirus-vs-edr-vs-mdr","Antivirus vs EDR vs MDR: Which Endpoint Protection Do You Need?","Antivirus, EDR or MDR? Detection, response, 24\u002F7 monitoring, in-house skills and cost model compared for small businesses with 10, 50 or 150 employees.",{"path":390,"title":391,"description":392},"\u002Fen\u002Fcomparisons\u002Fbusiness-password-managers","1Password vs Bitwarden vs Keeper vs Dashlane for Business","1Password, Bitwarden, Keeper or Dashlane? Canadian data hosting, SSO, SCIM, pricing and compliance compared side by side for Canadian small businesses.",{"path":394,"title":395,"description":396},"\u002Fen\u002Fcomparisons\u002Fedr-for-small-business","EDR for SMBs: Defender, CrowdStrike, SentinelOne, Sophos","Defender for Business, CrowdStrike Falcon, SentinelOne or Sophos: which tiers actually include EDR, published prices, Canadian data hosting and 24\u002F7 coverage.",1792972906235]