A file appears on every company laptop, so it feels protected. Then someone deletes the folder, and that deletion synchronizes everywhere.
Cloud storage can be excellent for collaboration. Cloud backup is intended to support recovery. Some products provide overlapping features, but the label alone does not tell you what can be restored, for how long, or after which kinds of incident.
For a small business, the decision should start with a recovery question: if an important file or account disappeared today, how would work resume?
Understand the difference in purpose
Cloud storage typically makes files available across devices and supports sharing. A backup service typically keeps recoverable copies according to a schedule and retention rules.
A storage service may offer version history and a deleted-item window. A backup service may have important exclusions. Neither category is a guarantee. Read the actual coverage, retention, restoration, and account-recovery terms for the product you are considering.
Do not assume a desktop backup includes email, CRM records, or accounting data stored inside a separate online application.
List the data that keeps the business running
Start with customer records, contracts, invoices, job files, email, website assets, and configuration information. Identify where each item lives and who administers it.
Then define two planning targets in plain language:
- Recovery point objective: how much recent work could reasonably be lost?
- Recovery time objective: how long could the business operate without the information?
These are targets to test, not promises created by writing them down. A daily backup may leave a gap approaching a day, and actual recovery time depends on data volume, bandwidth, systems, and staff.
Evaluate coverage before storage capacity
A large storage allowance is not useful if the tool skips important folders or unsupported applications. Ask:
- Which devices, folders, and online services are included?
- Are open files, external drives, and remote devices covered?
- How are permissions, ownership, and metadata restored?
- How long are previous versions and deleted files retained?
- What happens when a user account is deleted?
- What fees apply to downloading or restoring data?
Request a list of exclusions in writing. Marketing language about backing up “everything” needs a precise definition.
Consider how an attacker could reach the copies
If the same compromised administrator account can delete production data and every backup, the copies may not provide enough separation.
Ask about separate credentials, MFA, deletion protection, immutable retention where appropriate, and offline or otherwise isolated copies. Understand who can change retention settings and whether changes take effect immediately.
The FTC recommends regular backups and describes keeping important backup copies off the network to support recovery from attacks. NIST also recommends protecting and testing backups. 1 2
No single configuration fits every company. Use qualified help if the consequences of data loss are substantial.
Run a restore test, not just a backup check
A green check mark shows that a process reported success. It does not establish that the restored files will be complete or usable.
Use non-sensitive sample data to delete a file, restore an older version, and recover a folder to an approved test location. Open the files. Check names, dates, permissions, and whether a normal employee can locate what they need.
For a business application, verify records and relationships rather than just counting downloaded files. An exported customer list may not include the related messages, attachments, or transactions required to resume work.
Record the steps, duration, failures, and person responsible. Repeat testing after important changes and on a schedule suited to the business’s risks.
Compare cost using the same recovery requirement
Suppose a fictional service charges $9 per device per month for five devices. That is $45 monthly, or $540 annually, before extras. A second service might charge by stored data instead.
These are illustrative numbers, not a quote. Compare the same retention period, data volume, included applications, support, and restoration needs. Include overage charges, recovery assistance, and any download or egress fees.
A cheaper plan that cannot meet the recovery requirement is not a like-for-like alternative.
Assign ownership and protect the records
Name someone to review failed jobs, changes in coverage, storage limits, and billing interruptions. Ensure there is an authorized backup administrator if that person is away.
Protect recovery instructions and credentials, but make them available through an appropriate emergency process. A backup is less useful if its only administrator loses access at the same time as the production system.
Check retention and deletion responsibilities with your advisers. Keeping every copy forever can create privacy and legal problems of its own.
Common questions
Is cloud storage ever enough?
Possibly, for a limited use case where its actual recovery features meet your documented needs. Verify that with a restore test rather than relying on the name.
Does backup stop ransomware?
No. It can support recovery, but prevention, detection, account protection, and incident response still matter.
Should we restore immediately after an attack?
Coordinate with qualified incident-response support. Restoring into a compromised environment can cause further loss, and evidence or notification duties may need attention.
Bottom line
Buy recovery capability, not just storage space. Know what is protected, isolate copies appropriately, and prove that someone can restore the information the business needs.
Related guides
Sources
1 FTC, Cybersecurity for Small Business.
2 NIST, Cybersecurity Basics.