Your NAS Keeps Files Handy.
It Is Not a Backup.

What a NAS actually does well

A network-attached storage device is genuinely useful technology. Before explaining what it does not do, it deserves an honest account of what it does do well, because this page is not an argument against owning a NAS.

A NAS gives every device on your network access to a common pool of storage without requiring files to live on any individual machine. Shared project folders, media libraries, and internal documents are all accessible from any computer in the office over the local network, typically at speeds far faster than an internet connection. That makes collaboration easier and keeps files out of individual laptop hard drives where they are harder to manage.

Most NAS units also run RAID internally, which means the device can survive a hard drive failure without going offline and without losing data in that moment. That is real availability protection and worth having. (For a full explanation of what RAID does and does not do, see the RAID is not a backup page.)

Many NAS devices also offer scheduled snapshots, which capture the state of your data at a point in time and let you roll back accidental deletions or file overwrites quickly, without calling anyone. For day-to-day mistakes, that is a useful feature. We will come back to its limits in a moment.

The point is: a NAS is worth having. The problem is not the device. The problem is relying on it as the only copy of your data, or treating it as a substitute for off-site backup.

Why a NAS alone is not a backup

A NAS is online, network-reachable, writable storage sitting inside your building. That description captures everything a backup is designed to protect against. Here is each gap in detail.

• Your NAS is reachable from the network, which means ransomware can reach it too. When a NAS is mapped as a drive on a workstation or accessible through a user account, any process running on that workstation under that account can read and write to the NAS. Ransomware running on a single infected PC does not stop at the local hard drive. It encrypts every file path it can reach through normal file-system access, including mapped network drives and accessible shares on your NAS. CISA's #StopRansomware guidance specifically recommends keeping at least one backup copy offline or air-gapped, not reachable from the running operating system, precisely because online storage is reachable. A NAS on the network does not satisfy that requirement.
• A user account or misconfiguration can delete or overwrite NAS data just as easily as local data. If a user account has write access to a folder on the NAS, a mistaken bulk delete, an overwrite, or a sync tool that mirrors deletions can wipe files on the NAS the same as on any local drive. The NAS being a "separate device" does not change the fact that it is writable storage accessible over the network. The device separation that matters for backup is not physical device count. It is whether the copy is reachable from the same network context that could be compromised.
• Your NAS is in the same building, which means the same physical risks apply. CISA's 3-2-1 backup rule calls for at least one copy stored off-site and physically separated from the primary data. A NAS sitting in your office, server room, or storage closet is subject to the same fire, flood, burst pipe, electrical surge, and theft events as every other piece of equipment in that building. A fire that takes out your workstations will take out your NAS. A flood that saturates the server room will saturate the NAS. Physical device separation within the same building is not off-site redundancy.
• NAS snapshots are genuinely useful, but they are not an off-site or air-gapped copy. Snapshots are one of the better features a NAS can offer and they are worth enabling. They provide fast rollback for accidental edits or deletions without restoring from a separate backup. However, snapshots live on the same device as your primary data. If the NAS itself is stolen, destroyed in a fire, or fails in a way that corrupts the volume, the snapshots go with it. More importantly for ransomware: an attacker or ransomware that gains administrative access to the NAS can delete or disable snapshots before or during encryption. Snapshots that are reachable from the network, on the same device as the data, by an account that may be compromised, are not an independent copy. They are a convenience feature, not a backup.
• RAID inside the NAS is availability, not backup. Many NAS units run RAID across their internal drives, and as covered on the RAID is not a backup page, RAID protects against a single drive failing inside the enclosure. It mirrors or distributes data across those drives continuously. That means it also mirrors every deletion, every ransomware encryption, and every corruption instantly. RAID inside a NAS keeps the NAS running through a hardware failure. It does nothing to protect against logical data loss, and it does nothing to provide an off-site copy.
• There is no enforced off-device version history. A common ransomware readiness recommendation is to retain at least 30 days of version history in a location that is separate from the primary data and not reachable from the network. CISA's 3-2-1 guidance is what calls for that off-site, separated copy. A NAS holds the current state of your files, and snapshots on the NAS hold recent states of those files on the same device. Neither satisfies the requirement for an independent, off-site copy with durable version history. If ransomware encrypted your files four days ago and you are discovering it today, any recovery path depends on having a copy that predates the encryption and was not reachable by the ransomware when it ran.

The pattern across all of these gaps is the same: a NAS is convenient, fast, shared storage that is online and reachable. Those are exactly the properties that make a storage location unsuitable as your only copy of critical data. A backup needs to be something an attacker, a user mistake, or a physical disaster cannot simultaneously destroy along with the primary data.

What a complete plan looks like

The good news is that adding proper off-site backup alongside a NAS is straightforward. The NAS continues doing what it does well, providing fast shared local access, and backup fills the gaps the NAS cannot address. The following criteria are grounded in CISA's 3-2-1 guidance and #StopRansomware recommendations.

• Apply the 3-2-1 rule. Keep at least three copies of your data on at least two different types of media, with at least one copy held off-site. Your NAS can serve as one of your local copies, but you still need an independent second copy and a physically separate off-site copy. The NAS fills the local copy slot. It does not fill the off-site slot.
• Maintain at least one copy that is not reachable from the network. CISA's #StopRansomware guidance calls for at least one backup that is offline or air-gapped, not accessible from the operating system or network during normal operation. An off-site encrypted cloud backup stored in a separate environment satisfies this in a way that a NAS, even a well-managed one, cannot. The key is that the copy cannot be reached and modified by anything running on your local network.
• Retain 30 or more days of version history off-site. Ransomware and accidental deletions are frequently not discovered immediately. Version history retained off the device and off the local network gives you a recovery point before the damage occurred. Snapshots on the NAS are useful for quick rollback of recent mistakes, but they are not a substitute for durable off-site version history.
• Schedule backups automatically. A backup that depends on someone remembering to initiate it will eventually be missed. Automatic scheduling removes that dependency. Set the schedule once and let it run without manual intervention.
• Enable failure alerts. You should not have to log in periodically to verify that a backup completed. A backup solution should notify you if a scheduled job fails or if too much time passes without a successful backup, so a gap in coverage does not go unnoticed until you need to recover.
• Test a restore on a regular basis. A backup that has never been tested is an assumption. Restore at least one folder or dataset from your off-site backup periodically to confirm that the data is intact and that you understand the recovery process before you are under pressure to use it. Annual testing is a minimum. Quarterly is better.

If you are evaluating how ready you are for a ransomware event specifically, the ransomware restore readiness guide walks through the questions worth asking before an incident occurs. For a full checklist covering backup requirements for small businesses with servers and multiple machines, see the small-business backup checklist. If you are also using a cloud sync tool to copy files from the NAS or your workstations to a service like Dropbox or OneDrive, the cloud sync vs. backup page explains why sync is not a substitute for backup either.