RAID Is Not Backup: A 3-2-1 Plan for SMB Storage

Leo · 2026-10

RAID Is Not Backup: What SMB Buyers Get Wrong

RAID is not backup. RAID (redundant array of independent disks) keeps a storage pool running when one drive fails. It does not protect against deletion, ransomware, fire, or a controller that dies and takes the array with it.

That distinction decides how you spec a small business storage purchase.

If you are an IT manager at a 50-person firm signing off on a NAS, the question is not “how many bays” but “what happens the morning after the worst day.” This guide gives you a 3-2-1 plan you can cost, size, and check before the PO goes out.

woCyber builds NAS and private cloud storage for channel partners, system integrators, and OEM programs from a Shenzhen production base with Beijing R&D. We see the same spec sheet mistake on both sides of the ocean: buyers pay for redundancy and call it a backup strategy.

How RAID quietly fails as a backup strategy

Because RAID only covers one failure class: a disk dropping out.

Every other risk passes straight through. A user deletes a folder and the array faithfully mirrors the deletion, and ransomware encrypts files and RAID writes the encrypted versions to every member disk. A power event kills the chassis and the data sits inside a box that will not boot.

There is a second trap. RAID 5 with large drives has a long rebuild window, and rebuilds are when arrays are most fragile, and a 4-bay box running RAID 5 is a fine availability tool. It is not a recovery plan.

• RAID protects uptime — one disk failure, no outage.
• Backup protects data — a separate copy you can restore from.
• Snapshots sit between them — fast rollback, but they live on the same hardware.

If your only copy of a file lives on the array, you have one copy. That is the whole argument.

What a 3-2-1 plan actually requires

Three copies of the data, on two different media types, with one copy off-site.

The rule is old and it still works because each clause removes a different failure mode, and three copies means two independent failures before you lose data. Two media types means a firmware bug or a bad batch of drives cannot wipe both, and one off-site copy means a fire, flood, or theft at the office is survivable.

For a small business, the practical translation looks like this:

Two media types is the clause most buyers skip.

A second NAS in the same rack is a second copy but not a second medium, and it shares the same power and the same room.

Sizing the backup copy without guessing

Start from the data you actually have, not the capacity printed on the box.

Usable capacity is smaller than raw capacity.

RAID 5 on four 8 TB drives gives you 24 TB usable, not 32 TB. Then subtract snapshots, which consume a meaningful slice of the pool depending on retention, and subtract the growth you expect over the warranty period.

Here is a worked example you can rerun with your own numbers.

Formula: usable TB = (drives − parity drives) × drive capacity × 0.9

Take a hypothetical 40-person architecture studio. It holds 6 TB of active project files and adds roughly 1.5 TB a year. Over a 3-year horizon that is 6 + 4.5 = 10.5 TB of primary data.

• Primary array: four 8 TB drives in RAID 5 → 24 TB raw, about 21.6 TB usable after the 0.9 factor.
• Local backup copy: needs to hold 10.5 TB plus one prior version, so plan 15 TB.
• Off-site copy: 10.5 TB, compressed where the file types allow.

The primary array is not the constraint.

The backup targets are. Buyers routinely overspend on the primary box and then have nothing left in the budget for copy two and three.

Which counts more for a small business: bays or network ports?

Ports, usually. Most SMB buyers over-buy bays and under-buy bandwidth.

A 4-bay NAS with 2.5GbE will finish a nightly incremental backup faster than an 8-bay unit choked by a 1GbE link.

If your backup window is six hours and your nightly delta is 400 GB, a 1GbE link needs about an hour of clean throughput. Fine, until the link is shared with staff traffic.

This is the editorial judgment worth arguing about: if the budget only stretches to one upgrade, put it into the network path and the second copy before you add drive slots. Bays are cheap to add later. A backup that never finishes inside its window is a backup you will quietly stop running.

For partners building a repeatable small-business bundle, a 4-bay chassis with 2.5GbE and tool-less hot-swap trays covers the majority of deployments.

If you are sourcing that class of unit for resale or private label, you can review the products/x4-oem platform and compare it against your current BOM. Specification and MOQ are confirmed per configuration at quotation.

What the off-site copy should look like in practice

The United States CISA guidance on data backups is a good neutral checklist for the off-site leg of the plan.

Two workable patterns, and the choice is mostly about budget and staff time.

Rotated drives. Two external drives, swapped weekly, one carried off-site. Cheap, no recurring fee, and it fails if nobody remembers the swap. Assign the task to a named person, not a team.

Cloud or second-site replication. The NAS pushes encrypted backups to object storage or to a branch office. Costs recur monthly, but it runs unattended. Watch the upload path: a 1GbE uplink and a 500 GB nightly delta do not mix.

Either way, encrypt the off-site copy before it leaves the building.

A stolen drive with unencrypted client files is a disclosure event, and in regulated sectors it is a reportable one.

Test a restore before you trust the plan.

Pick a random folder, restore it to a scratch volume, and time it, and a restore you have never run is a hypothesis, not a backup.

How do you budget a 3-2-1 plan for a small business?

Budget the three copies as one line item, not three purchases.

Most SMB storage budgets get built around the primary NAS and then absorb the backup costs as an afterthought.

Reverse it. Decide the recovery point objective (RPO: how much data you can afford to lose, usually measured in hours) and the recovery time objective (RTO: how long a restore may take) first. Those two numbers set the spend.

• RPO of 24 hours → nightly backup is enough.
• RPO of 1 hour → you need snapshots plus replication, and the budget moves.
• RTO of 4 hours → keep a warm spare device on site.

Our guide to how-to-budget-for-on-premise-storage walks through the line-item structure for an on-premises deployment, including the costs buyers forget: drives for the backup target, UPS, and the staff hours for restore testing.

If you are sourcing hardware for multiple client sites as an integrator, the same logic scales across a fleet.

Standardize on one chassis family so spare drives and trays are interchangeable, and so a failed unit can be swapped without re-qualifying a new platform.

What to verify with a storage supplier before signing

Ask for documents, not adjectives.

For export buyers, the compliance file is the first checkpoint.

woCyber ships with CE, UKCA, FCC, RoHS, REACH, and WEEE documentation. Those are declarations and test reports, not marketing claims — request the actual files and check the model numbers match the unit you are buying.

Then check the manufacturing reality. Our production runs out of a Shenzhen base with 500K+ units shipped to date, covered by a standard 3-year warranty. Beijing handles R&D. A supplier who cannot tell you where the units are built is a supplier you cannot audit.

Our storage-oem-partner-checklist-7-checks-before-you-sign covers the seven checks we think every OEM buyer should run, from firmware ownership to RMA turnaround.

MOQ, lead time, and payment terms are confirmed per configuration at quotation — get them in writing before the sample order.

The takeaway is blunt: RAID is not backup, and the 3-2-1 plan is what turns a single appliance into something you can actually recover from.

Frequently asked questions

Is RAID 1 a backup?

No. RAID 1 mirrors one disk to another, so a single drive failure causes no outage. It does not protect against deletion, ransomware, or controller failure, because both mirrors are written at the same time, and treat RAID 1 as availability, and keep a separate backup copy.

Can I use snapshots instead of a backup?

Snapshots are a fast rollback tool, not a backup and they usually live on the same array, so losing the chassis loses the snapshots too. They are excellent for accidental deletion within a short window. They do not replace an off-site copy.

How many drives do I need for a 3-2-1 plan?

At minimum, the drives inside the primary array plus the drives in the local backup target plus the off-site medium.

A 4-bay primary in RAID 5 with a separate 2-bay backup unit and one rotated external drive is a common small-business shape, and size each tier from your data volume, not from the bay count.

Does a 3-2-1 plan work without cloud storage?

Yes. Rotated external drives carried off-site satisfy the off-site clause with no recurring fee, and the trade-off is staff discipline: someone must own the swap schedule. Cloud replication costs money but runs unattended, which suits smaller teams.

What is the difference between RPO and RTO?

RPO is how much data you can afford to lose, measured in time — a 24-hour RPO means a nightly backup is acceptable, and rTO is how long a restore may take before the business is hurt. Set both before you choose hardware, because they determine the backup frequency and the spare capacity you need.

Should the backup target be the same model as the primary NAS?

Not necessarily, but keeping one chassis family simplifies spares and staff training.

The important rule is that the backup target is a separate device on separate media, ideally in a separate room, and two identical units in the same rack share the same power and the same physical risk.