Guide · 7 min · For Owners

The terms, untangled

Three words get used loosely. They're not the same thing:

The question "offsite vs cloud" is slightly the wrong question. Cloud is a way to do offsite. The real questions are: do you have a local copy for speed, do you have an offsite copy for disaster survival, and is at least one copy immutable so ransomware can't delete it?

The 3-2-1 rule (and the modern update)

The long-standing rule:

The modern update, 3-2-1-1-0, adds two elements that ransomware made necessary:

Why immutability beats location

Here's the failure mode that catches small businesses: they have a cloud backup, they feel safe, and then ransomware encrypts everything anyway — including the cloud backup.

Modern ransomware doesn't just encrypt the primary data. It hunts for the backup first. It deletes Windows shadow copies, terminates the backup service, and — critically — if it can authenticate to your cloud backup (because the credentials are stored on the compromised machine), it deletes that too. A cloud backup that the attacker can log into and delete is not protected just because it's "in the cloud."

Immutability is the defense. An immutable backup cannot be modified or deleted for a defined retention window — not by the attacker, not by a rogue admin, not by anyone, until the retention expires. That's the property that makes the backup survive the attack. Location (local vs. cloud) is secondary to immutability.

The recommended small-business architecture

For most small businesses, the right backup is a hybrid:

  1. Local appliance — a backup appliance on-site that takes image-level backups of servers and critical workstations on a frequent schedule (every 1–4 hours for servers). This is your fast-restore copy.
  2. Immutable cloud copy — the local appliance replicates to immutable cloud storage on a daily (or more frequent) cadence. This is your disaster-survival and ransomware-proof copy.
  3. SaaS backup — a separate backup of Microsoft 365 or Google Workspace (mail, OneDrive/Drive, SharePoint, Teams). The cloud productivity suite is not backed up for you in the way owners assume.

This gives you: minutes-to-hours restore for routine failures (from the local appliance), survival of a site disaster (the cloud copy), and survival of ransomware (the immutable cloud copy plus immutable local snapshots).

Restore speed: the number that actually matters

Backups are measured by two numbers nobody talks about until they need them:

Set both targets deliberately. A medical clinic that can't see patients without the EHR has a tighter RTO than a back-office that can wait a day. The backup design follows from the targets, not the other way around.

The Microsoft 365 blind spot

The single most common backup gap we find: businesses assume Microsoft backs up their 365 data. Microsoft does not, in the sense owners mean. Microsoft operates a shared-responsibility model — they keep the service available and protect against their own infrastructure failures, but recovering your data from accidental deletion, malicious deletion (a departing employee), or ransomware is your responsibility. Native retention is short.

A separate SaaS backup of Microsoft 365 (and Google Workspace) — mail, OneDrive/Drive, SharePoint, Teams — is a baseline control. The same is true for any cloud LOB application that holds data you can't afford to lose.

How a Micro-IT plan handles backup

Every Micro-IT environment gets image-level backup on servers and critical endpoints to a local appliance, replicated to immutable Datto cloud storage, with retention set per the client's regulatory and operational needs. Restores are tested on a documented cadence (not just scheduled). SaaS backup of Microsoft 365 mailboxes is included in Managed Inbox. RPO and RTO targets are set with the client at onboarding and reviewed quarterly. See backup is the answer; restore is the test for the testing discipline, or the security page for the full stack.

Frequently asked questions

What's the difference between offsite backup and cloud backup?
Offsite backup means a copy of your data stored at a different physical location than the original — historically a tape or drive taken to another building. Cloud backup is a specific kind of offsite backup where the copy lives in a cloud provider's data center. All cloud backup is offsite; not all offsite backup is cloud. The modern answer is usually a hybrid: a local copy for fast restores plus a cloud copy for disaster survival.
What is the 3-2-1 backup rule?
3 copies of your data, on 2 different types of media, with 1 copy offsite. A modern update adds a fourth and fifth element — 3-2-1-1-0: one of the offsite copies is immutable or air-gapped, and there are zero errors on the last restore test. The immutability is what makes the backup survive ransomware.
Why does immutability matter more than location?
Ransomware now targets the backup before encrypting the primary data — it deletes shadow copies, kills the backup service, and encrypts any backup it can reach. A cloud backup that the ransomware can authenticate to and delete is not safe just because it's in the cloud. An immutable backup cannot be altered or deleted for a defined retention period, even with admin credentials — which is exactly what defeats the attack.
Is cloud backup enough on its own?
It can be, but a local copy plus cloud is usually better for a small business. The local copy gives fast restores (restoring a 2TB server over the internet takes a long time; restoring from a local appliance takes minutes to hours). The cloud copy gives disaster survival (fire, flood, theft of the local appliance). The combination — local appliance plus immutable cloud — is the standard for business-grade backup.
Does Microsoft 365 back itself up?
No — not in the way most owners assume. Microsoft operates under a shared-responsibility model: they keep the service running and protect against their own infrastructure failures, but recovering your data from accidental deletion, malicious deletion, or ransomware is your responsibility. The default retention is short. A separate SaaS backup of Microsoft 365 (and Google Workspace) is a baseline control, not an optional extra.

Related reading