Backup & Continuity

On-site vs cloud vs hybrid backup: which is right for your business?

Compare on-site, cloud and hybrid backup for UK SMEs: restore speed, resilience, cost and management, plus why the 3-2-1 rule and immutable copies now matter.

By Dig IT SolutionsUpdated 8 September 20265 min read

Short answer

On-site backup restores fastest but dies with the building. Cloud backup survives fire, flood and theft but restores over the internet. Hybrid backup keeps a local copy for speed and a cloud copy for resilience, which is why it is the right answer for most SMEs. Add an immutable copy that ransomware cannot delete and you meet the 3-2-1 rule.

Every business knows it should back up. The harder question is where the copies should live. On-site is fast, cloud is safe from the building, and hybrid tries to be both. This article compares the three on the things that matter to an SME buyer, restore speed, resilience, cost and effort, and explains why the answer for most businesses with a server or significant local data is hybrid with an immutable copy.

On-site backup

Data is copied to a device on your premises: a Synology NAS, a backup appliance or, in the worst cases, an external drive somebody remembers to swap.

Strengths. Restores run over the local network, so a deleted folder is back in seconds and a whole server image in an hour or two. Costs are predictable once the hardware is bought. Data never leaves the building, which some organisations prefer.

Weaknesses. The backup shares every risk the building has: fire, flood, theft, power surge. If the device sits on the same network with the same credentials as the servers, ransomware that reaches the servers usually reaches the backup. Someone has to check the jobs, replace failed disks and expand capacity. As the only copy, on-site backup is a single point of failure.

Cloud backup

Backup software encrypts data and sends it to a provider's data centres on a schedule. The provider maintains the hardware and, on business services, offers long retention and immutable storage.

Strengths. Off-site by definition, so it survives anything that happens to the office. Capacity grows without buying hardware. Little to maintain locally. Restores can be run from anywhere, which suits remote teams and multi-site businesses.

Weaknesses. Restore speed depends on your connection: a single file is quick, a multi-terabyte server image is not. Costs are ongoing and grow with data. The first full upload of a large dataset can take days. And it still needs someone to check that the jobs ran.

Hybrid backup

A local copy for speed plus a cloud copy for resilience, usually produced by the same backup job. A typical SME design is a server backed up to a Synology NAS several times a day, with the NAS replicating to cloud storage overnight and an immutable snapshot retained on one or both.

Strengths. Fast restores from the local copy for the common failures. An off-site copy for the rare catastrophic ones. Meets the 3-2-1 rule by design. Cloud costs can be lower because the cloud copy is the second tier rather than the working copy.

Weaknesses. Two systems to configure and monitor. A higher one-off cost for the local device. Retention and immutability need to be set deliberately on both sides.

Side by side

	On-site	Cloud	Hybrid
Restore a file	Seconds	Minutes	Seconds
Restore a server	Hours	Day or more	Hours
Survives fire, flood, theft	No	Yes	Yes
Survives ransomware on the network	Only if isolated or immutable	Yes, if immutable	Yes, with immutable copy
One-off cost	Device	None	Device
Ongoing cost	Low	Per GB per month	Per GB, usually lower tier
Management effort	High	Medium	Medium, best managed
Meets 3-2-1 alone	No	No	Yes

What Dig IT does in practice

For Mr Plant Hire, a multi-depot plant and tool hire business we have supported for over 15 years, the Windows servers are backed up locally several times a day and to the cloud. The local copy means a server fault costs hours of work rather than a day, and the cloud copy means a fire at the depot would not take the business's records with it. That is the pattern we recommend for most businesses of up to 250 people with a server, and it is the basis of our backup and disaster recovery service.

Immutability is no longer optional

Whichever strategy you choose, one copy must be something an attacker with your administrator password cannot delete. Ransomware groups look for backups first. The National Cyber Security Centre's guidance on offline backups in an online world sets out why a copy that is offline or immutable is the control that turns an attack into a recovery job rather than a ransom negotiation. Synology NAS devices support immutable snapshots, and business cloud backup services offer immutable retention. Turn it on.

Choosing for your business

Little local data, everything in Microsoft 365: cloud backup of Microsoft 365 plus cloud backup of the few PCs that hold anything. Read does Microsoft 365 include backup before assuming Microsoft has it covered.
A server or NAS holding business data: hybrid, with the local copy sized for fast restores and an immutable cloud copy.
Multiple sites: hybrid at each site holding data, or local backup replicating to a central NAS and then to the cloud.
Regulated data with a fast recovery requirement: hybrid with frequent local snapshots, and a tested restore time that matches your recovery time objective.

The deciding factor is the recovery time objective for each system. If a server being down for a day is tolerable, cloud alone may do. If it is not, you need a local copy. Our guide to RTO vs RPO shows how to set those numbers.

Managed or DIY?

The design matters less than whether someone checks it. The most common backup failure we see is not a bad strategy but a good one nobody monitored: a job that started failing in March and was discovered in June. A managed backup service monitors every job daily, fixes failures, runs scheduled test restores, manages retention and capacity, and reports on all of it. For a business without an internal IT team, that is usually the difference between having backups and having a recovery.

What to do next

If you are not certain which copies you have, where they are and when one was last restored, that is the place to start. Book an IT health check and Dig IT will review your current backups against the 3-2-1 rule and your recovery objectives, and tell you what would need to change.

Frequently asked questions

Is cloud-only backup enough for a small business?

For a business with little on-site infrastructure and modest data, it can be, provided retention is long enough and one copy is immutable. The weakness is restore speed: pulling a full server image back over broadband can take a day or more. If your recovery time objective for a server is measured in hours rather than days, you need a local copy as well.

Are on-site backups still worth having?

Yes, for speed. A Synology NAS on the local network restores a file in seconds and a whole server in an hour or two, which is what keeps a hardware failure to an afternoon's disruption. The rule is that on-site backup must never be the only copy. It shares the building's risks and, if it is on the same network, the same ransomware.

What is an immutable backup?

A backup copy that cannot be changed or deleted for a set period, even by an administrator account. Ransomware operators routinely delete backups before encrypting live data, so a copy that cannot be deleted is the difference between restoring and paying. Immutability is available on modern NAS devices such as Synology and on business cloud backup services, and should be part of any hybrid design.

How much does hybrid backup cost compared with cloud only?

Hybrid adds a one-off cost for the local device, typically a NAS sized to your data, on top of the cloud subscription. In exchange, restores are faster, cloud storage can be tiered more cheaply because it is the second copy, and you are not dependent on broadband speed to recover. For most businesses with a server or significant local data, the local device pays for itself the first time it is used.

Does Microsoft 365 data need backing up too?

Yes. Email, OneDrive, SharePoint and Teams are not covered by a server backup, and Microsoft's own retention is limited and not designed for recovery from deletion, ransomware sync or a departed employee's mailbox. A separate Microsoft 365 backup with its own retention belongs in the plan regardless of which strategy you choose for on-premises data.

Who should manage the backups?

Someone who checks them every day. Most backup failures are silent: a job fails overnight, nobody notices, and the discovery comes weeks later when a restore is needed. A managed backup service monitors every job, resolves failures, tests restores on a schedule and reports on it, which is why many SMEs hand this to their IT provider rather than to whoever is nearest the server.