The short answer: Choose a NAS for your small business based on how quickly you need to recover data, how fast your data is growing, and where it will be backed up. The raw disk capacity matters less. Installation must cover user accounts and permissions, snapshots, off-site backups, and secure remote access. At handover, the customer should receive documentation and full administrative access.
A NAS should be designed around operations, not terabytes
A business NAS is not just a place to store documents. It determines who can access contracts and how quickly you can recover a folder deleted by mistake. It also determines what happens when a disk fails and whether your data survives theft, fire, or ransomware.
The design process therefore does not begin with choosing a model. First, we need to know:
- how much data the business actually uses and how quickly it is growing,
- how many people work with the files at the same time,
- whether the NAS will store only documents or also databases, virtual machines, or security camera footage,
- how much downtime the business can tolerate,
- which data must remain available even after an attack or the destruction of the office,
- who will manage the NAS after handover.
The result should not be a device that only one technician understands. The customer receives administrative access, a description of the configuration, and a recovery procedure. If you would like us to handle the design, installation, and handover, we can do it for you in Brno as part of our business IT services.
Two, four, or more drive bays?
The number of bays determines more than today’s capacity. It also affects which redundancy option you can use, how the array can be expanded, and how long rebuilding the array will take after replacing a failed disk.
| Number of bays | When it makes sense | Main limitation |
|---|---|---|
| 2 | Smaller document volumes, simple file sharing, separate backup elsewhere | Mirroring leaves roughly half of the raw capacity usable; dual-parity arrays are not possible |
| 4 | Typical small business, growing data volumes, snapshots, multiple backup jobs | Higher purchase price, but significantly more configuration options |
| 6 or more | Virtual machines, larger databases, video, or a requirement for a dual-parity array | Greater demands on cooling, UPS capacity, administration, and recovery planning |
A two-bay Synology DS224+ may be sufficient for office documents. A four-bay Synology DS923+ or QNAP TS-464 leaves room for expansion and alternative array layouts. However, none of these is a universal recommendation. Before purchase, we check processor performance, memory capacity and expandability, network interfaces, supported file systems, and disk compatibility. Synology has changed its rules for third-party disks in newer product lines, so we verify the current compatibility list for every model.
The differences between DSM and QTS, including the limitations of individual product lines, are covered in our Synology and QNAP comparison for businesses.
SHR or conventional RAID?
Synology Hybrid RAID (SHR) makes it easier to expand an array gradually and to use disks of different sizes. With two disks, SHR-1 behaves like a mirror. With three or more disks, it works similarly to RAID 5 and can withstand the failure of one disk. SHR-2 provides redundancy for two disk failures and requires at least four disks.
We use conventional RAID when a business wants a standard, predefined layout. RAID 1 mirrors two disks. RAID 5 uses the capacity of one disk for parity and requires at least three disks. RAID 6 uses the capacity of two disks for parity, while RAID 10 combines mirroring with striping. Both RAID 6 and RAID 10 require at least four disks.
Neither SHR nor RAID protects against file deletion, ransomware, administrator error, or the destruction of the entire NAS. Their purpose is to keep the system running when a disk fails. Usable-capacity calculations and the risks associated with each level are summarised in RAID 0, 1, 5, 6, 10, and SHR in practice.
Why just any „NAS disk" is not enough
For business arrays, we select product lines that use CMR recording technology and are designed for continuous operation: WD Red Plus and Red Pro, Seagate IronWolf and IronWolf Pro, or Toshiba N300.
However, the „Red" label alone is not enough. Standard WD Red drives with capacities from 2 to 6 TB and model numbers ending in EFAX, such as the WD40EFAX, use SMR recording. Their performance drops significantly during prolonged continuous writes, typically while rebuilding an array after replacing a disk. The rebuild can then take a very long time, or the disk may drop out of the array entirely. The overview of CMR and SMR drives explains how the technologies differ and how to identify them from model numbers.
WD Purple is intended primarily for surveillance recorders and continuous video recording. It is not a substitute for a NAS disk used for documents, databases, or virtual machines.
When choosing disks, we consider not only capacity but also expected data growth and the rebuild time of large drives. It is also important that a replacement disk be readily available and that the volume retain enough free space for snapshots.
A Btrfs snapshot is not a backup, but it can quickly undo mistakes
On compatible Synology models, we create a Btrfs volume. We enable data integrity protection through checksums for important shared folders. This setting must be selected when the folder is created and cannot be enabled later. Checksums can detect a corrupted data block that the disk’s SMART monitoring does not identify. If the array is redundant, DSM can repair the block using the other intact copy.
A snapshot captures the state of a shared folder at a specific point in time. It allows a user to recover a document that was accidentally overwritten or deleted. A typical starting point is one snapshot every hour during business hours, with daily snapshots retained for a longer history. The final configuration depends on the volume of changes and the available space.
However, snapshots remain on the same NAS. If the device fails, is stolen, or an attacker gains control of an administrator account, you may lose both the data and the snapshots. On supported models, DSM 7.2 introduced immutable snapshots that cannot be deleted even by an administrator during the selected retention period. Their retention must be planned in advance because they continue to occupy space until they expire.
What we actually configure during installation
Creating the storage pool is only the beginning of the installation. Our standard configuration includes:
- an individual account for each user instead of one shared login,
- role-based groups, such as management, accounting, and sales,
- shared folders and permissions based on actual work requirements,
- a separate administrator account with multi-factor authentication and the default
adminaccount disabled, - snapshots, retention policies, and free-capacity monitoring,
- scheduled array integrity checks (data scrubbing) and SMART tests,
- alerts for disk health, backup failures, temperature, and storage utilisation,
- an update plan for DSM or QTS and installed packages,
- controlled shutdown through a compatible UPS connected by USB or over the network,
- a backup of the NAS configuration.
We verify permissions by signing in as a regular user. The administrator’s view is not sufficient because administrators can see everything. It will not reveal that an employee can open someone else’s folder or, conversely, cannot access their own files.
Off-site backup following the 3-2-1 rule
The 3-2-1 rule means keeping three copies of your data on two different storage systems, with one copy located away from the primary site. RAID and snapshots on the same NAS do not constitute three independent copies.
The remote destination may be a second NAS in another building, object storage, or a managed cloud backup. Synology provides Hyper Backup and Snapshot Replication for this purpose, while QNAP offers Hybrid Backup Sync. The backup destination must not share credentials with the administrator of the production NAS. If an attacker obtains a single account with access to everything, they can delete the backup as well.
A green job-status icon after the first run is not enough. We restore a selected folder to another location and record the date, restored sample, and result in the documentation. The guide to testing and documenting backup recovery explains how to perform and record such a test.
We do not expose a NAS directly to the internet
SMB file sharing, the DSM or QTS administration interface, and SSH should not be accessible from the internet through forwarded ports. In 2022, DeadBolt ransomware specifically targeted internet-accessible QNAP devices and encrypted data directly on the NAS. We therefore disable UPnP on the router and remove unnecessary port-forwarding rules. We also disable automatic port forwarding configured through the NAS.
Synology QuickConnect is not the same as manually opening a port, but it still creates an external route to the device. If the business does not need it, we disable it. If remote access is required, we restrict the available services and enable multi-factor authentication. A business VPN or ZTNA is preferred.
A service provider managing the device remotely should not sign in with the customer’s primary account. The provider receives a named service account with restricted permissions, which the customer can disable at any time.
How NAS installation in Brno works
First, we review the data, users, applications, and existing backups. Based on this information, we propose the device, disks, array layout, usable capacity, and off-site backup solution.
We prepare, update, and test the NAS before migration begins. We plan the migration so that it is clear when the old storage becomes read-only and when employees should start working on the new system. After copying the data, we compare file counts, check permissions, and confirm that important files open correctly.
The handover includes a practical test. A user signs in and opens a shared folder. We restore a file from a snapshot, check the latest backup, and explain what each alert means.
If you are dealing with an existing NAS that has a degraded array or an inaccessible volume rather than planning a new installation, do not rebuild or initialise anything. A simple initial assessment of the NAS and its disks may be free of charge; we provide a quotation in advance for analysing multiple disks or reconstructing an array.
What the handover documentation should contain
At a minimum, the customer receives:
- the manufacturer, model, serial number, and the disk installed in each bay,
- a description of the storage pool, RAID or SHR type, and file system,
- a list of shared folders and an overview of permissions,
- the network configuration and physical location of the device,
- backup jobs, their destinations, and retention policies,
- snapshot, integrity-check, update, and alert settings,
- a record of the first recovery test,
- administrative access credentials delivered through a secure channel,
- procedures for disk failure, NAS downtime, and backup failure.
Passwords do not belong in a PDF sent by email. We deliver them separately, ideally directly into the customer’s password manager. The business can therefore take over administration at any time or transfer it to another service provider.
How much installation costs and what the quotation should include
The price depends on the NAS model, number of users, volume of data to be migrated, complexity of permissions, backup destination, and scope of the documentation. The quotation should list the hardware, disks, UPS, backup storage, migration work, and any ongoing administration separately.
A low price for the NAS itself says nothing about whether the data can be recovered or whether the solution can be properly handed over. If you are also considering ongoing support, our article on the cost of IT management for a small business provides indicative figures.
How to recognise a properly handed-over NAS
Once the work is complete, you should be able to answer five questions:
- Who has administrative access?
- Who can see each folder?
- When was the last backup completed?
- Can we recover a specific file?
- What will we do if a disk fails?
If only the service provider knows the answers, the NAS has not been properly handed over.
Frequently asked questions
Is a two-bay NAS enough for a small business?
Yes, if the business has a smaller volume of documents, needs simple file sharing, and maintains a separate backup outside the NAS. A four-bay model is worthwhile if you expect the data volume to grow, want more redundancy options, or need to separate different workloads.
Is Synology SHR better than RAID 1?
With two disks of the same size, the outcome is practically identical: the data survives the failure of one disk. SHR is more flexible if you later add disks or replace them with larger ones. RAID 1 is a simpler and more predictable choice if you do not plan to expand the array.
Do snapshots protect against ransomware?
They allow you to recover older versions of files quickly, but a standard snapshot on the same NAS is not a separate backup. Protection against ransomware requires an isolated copy outside the NAS with separate credentials and, where possible, immutable snapshots.
Does QuickConnect need to be enabled?
No. If employees work only in the office or connect through a VPN, it can remain disabled. If there is a specific reason to use it, we restrict the available services and secure the accounts with multi-factor authentication.
Will we receive all access credentials after installation?
Yes. The administrative account and documentation belong to the customer. If ITHOPE provides ongoing management, we use a separate service account. The device must not be technically dependent on us alone.
Where to find us
ITHOPE is a company based in Brno, Czechia: we do data recovery from disks, RAID and NAS, PC and laptop service and IT for business, all in our own lab at Viniční 3587/216, 615 00 Brno.
Phone +420 775 556 063 (24/7 line). You can bring the device in person, or send it by courier (Zásilkovna, PPL).