# Backups: Local NAS vs Cloud vs Immutable Storage vs Hybrid

Source : https://cybercaribou.com/en/comparisons/backup-nas-vs-cloud-vs-hybrid · Cyber Caribou

> On-site NAS, cloud backup, immutable storage or a hybrid 3-2-1-1-0 setup: ransomware resilience, restore speed, cost model and Canadian data residency compared.

Almost every small business has a backup. Far fewer have one that would survive ransomware. The Canadian Centre for Cyber Security puts it plainly: threat actors can attack NAS devices, and ransomware can spread to them. The UK NCSC adds that connected cloud backups have been compromised too.

So the real question isn't "NAS or cloud?" It's this: which copy will still be intact on the day an attacker holds your admin credentials? This comparison lines up four approaches, from the simplest to the most robust. For the rule itself, read our article on the [3-2-1-1-0 backup rule](https://cybercaribou.com/en/blog/3-2-1-1-0-backup-rule-ransomware).

- We compare approaches, not products. Every value in the table is based on publications from the Canadian Centre for Cyber Security, the UK NCSC, CISA and NIST, reviewed in October 2026.
- Criteria: ransomware resilience, deletion with a stolen account, restore speed, off-site copy, cost, Canadian hosting, management effort and what the authorities recommend.
- No prices are quoted: cost models are described qualitatively.
- This comparison is not sponsored.

## The NAS: fast, but within the attacker's reach

A NAS has one real advantage: speed. The Canadian Centre for Cyber Security notes that on-site storage is convenient, can save time and keeps backups readily available when you start a recovery. To restore a folder deleted by mistake or a failed server, nothing beats a copy on the local network.

Its two weaknesses are well known. First, it shares the fate of the building: a fire or flood takes out the original and the copy. Second, it's reachable from the network, often with the same admin accounts. An attacker who takes over the network finds the NAS and wipes it before launching encryption.

## The cloud: off site, but not automatically safe

Cloud backup solves the disaster problem and the "someone forgot" problem: it's automatic and off site. The UK NCSC points out, however, that it needs a reliable internet connection both to back up and to restore. For a handful of files, that hardly matters; for a full server, the delay depends directly on data volume and your bandwidth.

On resilience, the cloud isn't magic. If an attacker can sign in to the console with a stolen account, they can delete the backups. The NCSC recommends checking that your cloud service protects previous versions from immediate deletion. Check the hosting region too: the Canadian Centre for Cyber Security reminds organizations that they remain legally responsible for their data, even with a provider.

## Immutability: the copy nobody can erase

Immutable storage, sometimes called object lock, prevents a backup from being changed or deleted during its retention period. It's the first of the NCSC's principles for ransomware-resistant cloud backups. The NCSC also recommends alerts on mass deletions or changes to retention settings, and an out-of-band way back into the service.

The trade-off: retention is set in advance. CISA advises using immutable storage with caution, since it doesn't meet the compliance criteria of certain regulations. Align the retention period with your policy for keeping and destroying personal information.

## Hybrid 3-2-1-1-0: speed and survival

The hybrid approach combines the strengths of the others. The local copy handles everyday incidents; the off-site, offline or immutable copy is there for the day everything else is compromised. It extends the Canadian Centre's 3-2-1 rule: three copies, on two types of media, one of them off site. The Centre's ransomware playbook also recommends at least two offline backups and a secondary backup in the cloud.

The last digit, zero errors, is the one most often forgotten. A backup that's never been restored is just an assumption.

## How to choose

First, agree on two numbers with management: your recovery time objective (RTO), meaning how long you can operate without your systems, and your recovery point objective (RPO), meaning how many hours of work you can afford to lose. Then:

- [ ] At least one copy is off site, and at least one is offline or immutable.
- [ ] The backup admin account is separate from the network account and protected by MFA.
- [ ] Backups are encrypted, and the key is stored elsewhere.
- [ ] You know the hosting region, and a privacy impact assessment is done if it's outside Québec.
- [ ] A full restore has been timed and compared with the RTO.

On the day of an attack, these choices carry a lot of weight: see our guide to the [first 24 hours of a ransomware attack](https://cybercaribou.com/en/blog/ransomware-first-24-hours). If your data is mostly in Microsoft 365, find out whether [you need a separate Microsoft 365 backup](https://cybercaribou.com/en/blog/microsoft-365-backup-do-you-need-it). Our [remediation and hardening](https://cybercaribou.com/en/services/remediation-hardening) service reconfigures your backups and documents a test restore.

## FAQ

**Is OneDrive or Dropbox sync a backup?**
Not really. Sync replicates changes, including files encrypted by ransomware or deleted by mistake. The UK NCSC notes that ransomware incidents have compromised connected cloud storage containing backups. Version history offered by some services helps, but check how long versions are kept and who can delete them.

**Does Québec's Law 25 require backups to stay in Québec?**
No. The law doesn't require hosting in Québec, but before personal information is communicated outside Québec, including to a provider that stores it for you, it requires a privacy impact assessment and a written agreement (s. 17). A cloud region in Ontario is therefore covered. Check your analysis with your legal counsel.

**How long does a restore from the cloud take?**
It mostly depends on data volume and your internet connection: the UK NCSC points out that cloud backup needs a reliable connection both to back up and to restore. The only way to know your real figure is to time a full test restore, then compare it with your recovery time objective (RTO).

**Should backups be encrypted?**
Yes. The Canadian Centre for Cyber Security's baseline controls call for backups to be stored in an encrypted state. Keep the key somewhere other than the backup itself: the UK NCSC suggests an out-of-band copy, such as a printed copy kept in a safe.

## Sources

- [Canadian Centre for Cyber Security: Tips for backing up your information (ITSAP.40.002)](https://www.cyber.gc.ca/en/guidance/tips-backing-your-information-itsap40002)
- [Canadian Centre for Cyber Security: Ransomware playbook (ITSM.00.099)](https://www.cyber.gc.ca/en/guidance/ransomware-playbook-itsm00099)
- [Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations](https://www.cyber.gc.ca/en/guidance/baseline-cyber-security-controls-small-and-medium-organizations)
- [Canadian Centre for Cyber Security: Developing your IT recovery plan (ITSAP.40.004)](https://www.cyber.gc.ca/en/guidance/developing-your-it-recovery-plan-itsap40004)
- [UK NCSC: Principles for ransomware-resistant cloud backups](https://www.ncsc.gov.uk/guidance/principles-for-ransomware-resistant-cloud-backups)
- [UK NCSC: Offline backups in an online world](https://www.ncsc.gov.uk/blog-post/offline-backups-in-an-online-world)
- [UK NCSC: Always back up your most important data](https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/always-back-up-your-most-important-data)
- [UK NCSC: Mitigating malware and ransomware attacks](https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks)
- [CISA: #StopRansomware Guide](https://www.cisa.gov/stopransomware/ransomware-guide)
- [NIST: recovery time objective (RTO) definition, SP 800-34 Rev. 1](https://csrc.nist.gov/glossary/term/recovery_time_objective)
- [LégisQuébec: Act respecting the protection of personal information in the private sector (P-39.1), s. 17](https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1)