Backup as a Service (BaaS) for SMEs: Outsourcing Your Cloud Backup

"But we've got backups, haven't we?" is something you often hear in small and mid-sized businesses, usually just before someone discovers that the external hard drive under the desk stopped running two years ago, or that the NAS in the server cupboard was encrypted by ransomware along with everything else. Backup as a Service (BaaS) is the modern answer: backup infrastructure from the cloud, priced per user or per TB, with the management handled by an external partner. In this article, we explain exactly what BaaS is, why the classic 3-2-1 rule is no longer enough, what NIS2 expects and what to look for in a provider.

What is Backup as a Service?

BaaS is a cloud-based backup service in which an external provider supplies the complete backup infrastructure: software, storage, encryption, retention policies and the tooling to restore. You install an agent on servers, laptops or VMs, or connect your Microsoft 365 tenant, and the rest happens automatically. You pay monthly per user, per workload or per TB.

The difference from "an external drive" or "a NAS in the annexe" comes down to three things: it is off-site by design, it is encrypted and versioned, and the management (updates, monitoring, capacity) lies with the provider. For SMEs, that often means backup becomes genuinely reliable for the first time, rather than something that is sorted on paper but not in practice.

The classic 3-2-1 rule: still the foundation

Every backup adviser starts with the 3-2-1 rule:

• 3 copies of your data: production plus two backups.
• 2 different media (for example local disk and cloud object storage).
• 1 copy off-site, physically separated from your main location.

This rule has been around for decades and it's the reason a single external drive under the desk isn't enough: nothing off-site and usually no second medium. BaaS solves the off-site and second-medium parts in one go: the cloud is off-site by definition, and a cloud provider's object storage is a different medium from your local disk.

Why 3-2-1 isn't enough in 2026: welcome to 3-2-1-1-0

Ransomware has changed the rules of the game. Attackers know backups are their biggest enemy and go looking for them explicitly: they scan backup servers, use stolen admin credentials and delete or encrypt backups before they hit production. Classic 3-2-1 backups that can be reached over the network are still vulnerable as a result.

That's why the modern standard is 3-2-1-1-0:

• 3 copies, 2 media, 1 off-site still stands.
• +1 immutable or air-gapped copy: a backup that cannot be changed or deleted within a retention period, even with stolen admin rights.
• +0 recovery errors: regular verification that a restore actually works.

Immutable storage (for example object lock on S3-compatible storage) is the single biggest anti-ransomware measure at the backup level. Every serious BaaS provider offers it as standard. Our complete guide to backup strategy goes deeper into the architecture.

RTO and RPO: the two numbers that decide everything

Before you choose a BaaS provider, answer two questions:

• RPO (Recovery Point Objective): how much data can you afford to lose at most? An RPO of 24 hours means losing up to a day's work; an RPO of 15 minutes requires near-continuous replication.
• RTO (Recovery Time Objective): how quickly must your system be running again? An RTO of 4 hours means everything is operational within 4 hours.

Without defining RTO and RPO, you'll end up picking a solution at random that is either too expensive or too lightweight. Our guide to the business continuity plan helps you set these numbers for each process.

NIS2 pressure on backups

The Cyberbeveiligingswet (Cybersecurity Act), the Dutch implementation of NIS2, was passed by the Dutch Senate on 7 July 2026 and came into force on 15 August 2026. Well over 8,000 Dutch organisations fall under the law. If you fall under NIS2 as an essential or important entity (usually 50+ employees or more than €10 million in turnover in a designated sector), you are required to take appropriate measures for business continuity, backup management and incident response.

In practice, the bar closely matches 3-2-1-1-0: a demonstrable backup strategy, at least one immutable copy and regularly verified recovery capability. Importantly, NIS2 is not only about the backup itself, but about proof that you test and document your restores. More in our NIS2 guide for SMEs.

Microsoft 365 and the shared responsibility misconception

One of the most persistent misconceptions among SMEs: "we run on Microsoft 365, so Microsoft does the backups". No. Microsoft provides the infrastructure, uptime and service-level security. You are responsible for your data, access management, compliance configuration and recovering whatever you accidentally delete or let get encrypted.

Replication is not backup: if someone wipes a SharePoint library or ransomware encrypts a OneDrive, Microsoft dutifully replicates that too. Retention policies help with compliance, but they are not a restorable backup. For proper M365 backup you need a separate solution. Microsoft's paid Backup add-on costs around $0.15 per GB per month; third-party BaaS typically costs between $2 and $6 per user per month.

What does BaaS cost for Dutch SMEs?

Prices vary by provider, licensing model and number of workloads. Benchmarks for 2026:

• M365 backup via third-party BaaS (Veeam Data Cloud, Acronis, Datto, AvePoint): $2 to $6 per user per month.
• Acronis Cyber Protect Cloud: base platform from around $85 per workload per year; with DR and security packs the price per workload is higher.
• Veeam Data Cloud: per user or per TB. Price increase of 4 to 8% from January 2026.
• Datto: prices cut by around 10% in January 2026, after Kaseya scrapped the High Watermark billing model in December 2025.

For an SME with 30 employees, an on-premises server and an M365 tenant, you will often be looking at €4,000 to €10,000 a year for a full BaaS solution with immutable retention. Add €2,000 to €6,000 one-off for implementation.

What to check when choosing a BaaS provider

Before you sign a contract, work through this checklist:

1. Immutable retention. Does the provider support unchangeable backups for at least 30 days? Without this, you're vulnerable to ransomware that targets your backups.
2. EU data residency. Where is your data stored? For GDPR, EU-hosted data is the norm, and some sectors (healthcare, finance, government) explicitly prefer hosting in the Netherlands.
3. Encryption at rest and in transit. Standard, but check whether you manage the keys yourself (BYOK) or the provider holds them.
4. Restore tests. How often are restores verified? Does the provider give you a periodic report?
5. RTO and RPO in the contract. Are these SLA figures written down, and what are the penalties if they're not met? Our guide to SLAs for IT services describes the building blocks you should insist on.
6. Egress costs. What does it cost to pull your entire dataset back from the cloud after a major incident? Some providers charge bandwidth fees that add up quickly.
7. Exit strategy. Can you get your data back in a usable format at the end of the contract? Cloud lock-in with backups is a real risk.

Benefits and limitations at a glance

Benefits:

• Off-site by design, automatically compliant with 3-2-1.
• No backup hardware of your own that needs replacing every 3-5 years.
• Predictable OpEx per user or TB instead of one-off CapEx.
• Immutable retention and encryption available as standard.

Limitations:

• Dependent on your internet connection and provider uptime; for a large restore, bandwidth is a real bottleneck.
• Recurring monthly costs that can climb steeply with large datasets.
• Egress costs during large-scale recovery sometimes come as an unpleasant surprise.
• Vendor lock-in: switching is complex and time-consuming.

When BaaS isn't the first choice

For a small business with only M365 and no on-premises servers, a dedicated M365 backup is often enough, rather than a full BaaS platform. For businesses with very large amounts of data (media, engineering firms with terabytes of project files), a hybrid model with a local immutable snapshot plus cloud tiering can be more economical. Doing the maths up front pays off: estimate total data volume, growth rate and expected restore frequency. If you have data sovereignty requirements, check explicitly where the provider runs its storage and who its sub-processors are.

How to approach a BaaS implementation

A BaaS rollout in an SME typically takes 3 to 8 weeks:

1. Data inventory: which workloads need backing up (servers, VMs, endpoints, M365, databases)?
2. Set RTO and RPO per workload; not everything needs to be restored equally quickly.
3. Provider selection and contract negotiation with attention to immutable retention, EU hosting and egress costs.
4. Initial upload. A bottleneck for large datasets; some providers offer a physical seed via a device.
5. Configure retention policies in line with GDPR, NIS2 and sector requirements.
6. Monitoring and alerting: who gets notified when a backup fails?
7. Restore test within a month of go-live. A backup that has never been restored is not a working backup.

Frequently asked questions about Backup as a Service for SMEs

What is the difference between BaaS and Disaster Recovery as a Service? BaaS focuses on storing and restoring data. DRaaS goes further: it also covers complete infrastructure and applications, with failover to a replica in the cloud within minutes to hours. DRaaS is more expensive but necessary with an RTO of a few hours or less. For SMEs with an RTO of 8-24 hours, BaaS is usually sufficient.

Does BaaS replace my local backup? It can, but it doesn't have to. A hybrid setup with a fast local immutable snapshot plus cloud BaaS gives you quick recovery from everyday incidents and full off-site protection in a disaster. Cloud-only works fine for smaller datasets.

Is Microsoft 365 already protected without a separate backup? No. Microsoft runs the infrastructure; your data (mail, SharePoint, OneDrive, Teams) is your responsibility. Retention policies and the recycle bin are not a restore. Third-party BaaS for M365 usually costs $2 to $6 per user per month.

What exactly does immutable backup mean? Unchangeable: within a set period, not even an admin can delete, modify or overwrite the backup. It protects against ransomware that tries to destroy backups. Object lock on S3 storage and WORM tapes are well-known forms.

What does BaaS cost for a business with 30 employees? Roughly €4,000 to €10,000 a year for a full solution covering M365, an on-premises server and endpoints, including immutable retention. Plus €2,000 to €6,000 one-off for implementation.

How often should I run a restore test? A partial restore at least every quarter, and a full recovery exercise every year. For NIS2, the recommendation is to document this: which test, when and with what result.

Conclusion

In 2026, BaaS is the most practical route for Dutch SMEs to a backup strategy that genuinely works: automatically off-site, immutable against ransomware and without the headaches of running your own backup infrastructure. The 3-2-1 rule remains the foundation, but 3-2-1-1-0 is the new norm, and NIS2 increasingly expects organisations to be able to prove they meet it. For most SME environments, the investment is between €4,000 and €15,000 a year, depending on size and scope.

Want to know which BaaS solution fits your data volume, RTO and compliance requirements, or do you urgently need something set up for NIS2 or a cyber insurance policy? TRON Group helps Dutch SMEs select, roll out and monitor BaaS 24/7 for Microsoft 365, servers and endpoints, with immutable retention and verified restores. Explore our cloud services or call +31 85 303 5869 for a conversation without the sales pitch. TRON Group. Moving IT Forward - IT that works, grows and protects.