The short answer
RAID is not a backup. It protects against a physical drive failing, and nothing else. Accidental deletion, ransomware encryption, fire, theft and silent file corruption all defeat RAID completely — and in the ransomware case, RAID faithfully replicates the damage across every disk in the array.
You need both: RAID so a dead disk is an inconvenience rather than an outage, and a real 3-2-1 backup — three copies, two media types, one offsite — so a bad decision or a bad actor is recoverable.
What each one actually protects against
| Threat | RAID | Backup |
|---|---|---|
| Single drive failure | Protects | Recovers, more slowly |
| Accidental deletion | No help | Protects |
| Ransomware | Replicates the damage | Protects, if a copy is offline or immutable |
| Fire, flood, theft | No help | Protects, if a copy is offsite |
| Silent corruption | Sometimes, with checksumming filesystems | Protects, with versioned history |
| Someone deleting the array | No help | Protects |
What a real backup looks like
- Three copies of anything you cannot afford to lose
- Two different media or systems, so one failure mode cannot take both
- One copy offsite, because fire and theft do not respect a server room
- At least one copy offline or immutable, because ransomware attacks the backups first
- Versioned history, so a file corrupted three weeks ago is still recoverable
- A documented restore test you have watched — this is the only part that constitutes evidence
The test that separates real from theatrical
Almost every business I audit has backups running. A much smaller number have ever restored one. Until you have watched your own data come back, you have a scheduled task and a hope.
Run a restore test at least twice a year, with the procedure written for someone doing it under pressure at 2am. If the only person who knows how is on holiday when it matters, you did not have a backup — you had a person.
FAQ
Related questions
Is a NAS enough on its own?
No. A NAS with RAID is a good primary copy, but it is one device in one building. It needs an offsite or cloud copy behind it, and ideally an immutable one.
Is cloud storage a backup?
Sync is not backup. If a file is deleted or encrypted locally, a syncing service happily propagates that. Use versioning and retention settings, or a real backup product pointed at cloud storage.
How often should we test restores?
Twice a year at minimum, and after any significant change to the systems or the backup configuration.