Cloud Data Backup Services for Small and Medium Businesses: 5 Criteria to Choose the Right Provider

Key Takeaways

• Cloud storage alone is not sufficient to protect business data: accidental deletion, ransomware, and misconfiguration can all wipe out "versioned" backups at the same time. In the first half of 2025 alone, ransomware caused over $10 million in damages in Vietnam, exposing more than 155 million data records.
• Decree No. 53/2022/ND-CP, long the reference point for the "24-hour / 24-month / 6-month" backup rule no longer serves as the primary legal reference. As of August 19, 2026, Decree No. 331/2026/ND-CP and Decree No. 333/2026/ND-CP, issued under the 2025 Cybersecurity Law that replaced the 2018 law, now form the current legal framework governing cybersecurity protection and data backup.
• Selecting a cloud backup service for SMEs requires evaluating five criteria simultaneously: technical capability (RPO/RTO), security, operations, compliance, and true total cost (not just storage pricing).
• GreenNode provides cloud data backup and recovery services with infrastructure located in Vietnam, encryption, automated snapshots, audit logging, usage-based GB pricing with no egress fees, and 24/7 support.

This article outlines the key criteria for selecting a cloud data backup service for small and medium businesses in Vietnam: comparing common service models, understanding real-world costs, and meeting current compliance requirements.

Where Standard Cloud Storage Falls Short in Enterprise Data Protection

Many small and medium businesses rely on Google Drive, OneDrive, or object storage and assume their data is "backed up." In practice, that assumption doesn't hold.

Three common scenarios illustrate the gap: a deleted customer folder syncs the deletion to the cloud instantly, ransomware encrypts files while they're actively syncing, or a server misconfiguration causes a database to overwrite its own data week after week. In each case, cloud storage "versioning" fails to help, because the damaging event propagates directly into the stored version itself.

This risk is no longer theoretical: Vietnam recorded roughly 552,000 cyberattacks in 2025, concentrated in the banking and finance, telecommunications, and public services sectors. For an SME, an attack like this can mean losing all customer records, order data, and financial documents within hours.

True cloud backup is fundamentally different: it creates an independent copy, isolated from the production environment, with a defined recovery point, and the ability to restore to a known-good state before the incident occurred.

Before selecting a service, two metrics need to be defined, per N-able's definition: RPO (Recovery Point Objective) — the maximum amount of data loss that is acceptable, measured in time — and RTO (Recovery Time Objective) — the maximum time allowed to restore systems and resume service. These two figures determine your entire backup architecture, from backup frequency to the type of service you need.

Cloud Backup Service Evaluation Checklist for SMEs

Before signing with any provider, evaluate the following five criteria:

1. Technical Criteria

• Does the service support your specific RPO/RTO targets? (e.g., RPO of 1 hour, RTO of 4 hours)
• Does it offer automated, scheduled snapshots? Does it support immutable backup or storage isolated from the production environment?
• Can recovery be performed at a granular level (individual files, VMs, or databases), or only as a full restore?
• Are periodic restore tests permitted, and do they incur additional fees?

2. Security Criteria

• Is data encrypted at rest and in transit? Which algorithms are used, and who manages the encryption keys?
• Is audit logging available to track who accessed, modified, or deleted a backup?
• Does access control support role-based permissions (RBAC)?

3. Operational Criteria

• Are backups scheduled automatically, or do they require manual intervention?
• Are alerts triggered when a backup fails? Who receives and acts on them?
• What SLA does the provider offer? Is 24/7 technical support available, including in Vietnamese?
• Is recovery time during peak hours explicitly committed to in the SLA?

4. Compliance Criteria

• Is backup data stored within Vietnam? (a critical requirement under the 2025 Personal Data Protection Law and the 2025 Cybersecurity Law — see the legal framework section below for details)
• Does the retention policy match the required cybersecurity protection level for your system? (a minimum of 24 months is a reasonable benchmark for core business data)
• Does the provider help you document your backup policy for audit purposes?

5. Cost Criteria

• Is pricing based on protected instances, storage volume (GB), or both?
• Are egress fees charged when restoring data?
• How does cost scale as backup volume grows over time?
• Is a lower-cost archive tier available for long-term retention?

If a provider cannot give clear answers across all five categories, that's a signal to look elsewhere.

Vietnam's 2026 Legal Framework for Data Backup and Recovery

The familiar "24-hour backup completion, 24-month minimum retention, 6-month recovery testing" benchmark under Decree No. 53/2022/ND-CP is now outdated. As of July 1, 2026, the 2025 Cybersecurity Law (Law No. 116/2025/QH15) replaced the 2018 law, meaning Decree No. 53/2022 is no longer the operative legal basis. As of August 19, 2026, the following two decrees became the new reference framework:

• Decree No. 331/2026/ND-CP: replaces the one-size-fits-all approach with a five-tier cybersecurity protection model (Tier 1: internal-use systems — Tier 5: strategic systems involving state secrets), requiring storage and backup measures proportional to each system's assigned tier rather than a single uniform standard.
• Decree No. 333/2026/ND-CP: sets out implementation measures; Article 6 requires organizations operating critical information systems to maintain a contingency backup plan and verify data recovery capability.

What SMEs should know: neither decree has yet published specific figures equivalent to the old "24 hours / 24 months / 6 months" benchmark. Businesses should determine which cybersecurity protection tier their systems fall under per Decree No. 331/2026, treat the previous benchmark as a reasonable minimum reference point for Tier 1 (core business) data, and confirm exact obligations with legal counsel. In practice: transaction, contract, and customer record data should be backed up daily with long-term retention; internal logs and reports can use an archive tier; real-time application data (POS, CRM) requires a short RPO of 1–4 hours.

In parallel, as of January 1, 2026, Decree No. 356/2025/ND-CP, implementing the 2025 Personal Data Protection Law, replaced Decree No. 13/2023/ND-CP, adding requirements such as designating a dedicated personal data protection officer or department. Vietnam's cybersecurity and data protection framework is being updated rapidly throughout 2026, so SMEs should review their backup and data protection policies on an ongoing basis rather than treating compliance as a one-time exercise.

The information above is provided for reference and compiled from publicly available sources. As detailed implementing guidance may still be forthcoming for these newly effective decrees, businesses should consult legal counsel to confirm exact obligations based on their system's protection tier and industry.

Choosing a Backup Method Based on RPO and RTO for SMEs

No single backup method fits every scenario. Below is an overview of six common backup approaches and when each is appropriate:

• Snapshot (redirect-on-write): captures system state at a point in time without copying all data; fast recovery, but storage overhead grows as changes accumulate, best suited for frequently changing workloads.
• Clone: replicates an entire environment along with its metadata; the most storage-intensive option, but recovery requires no "chaining."
• Full backup: a complete copy at the time of execution; the simplest to restore, but time- and bandwidth-intensive if run frequently.
• Differential backup: captures changes since the last full backup; restoring requires only the full backup plus one differential, making it faster than incremental restores.
• Incremental backup: captures changes since the most recent backup of any type; the fastest and lightest to run, but restoring requires "chaining" the full backup with every subsequent incremental, which takes longer.
• Changed block / delta tracking: not a backup type itself, but a capability that makes incremental and differential backups more efficient by tracking exactly which blocks changed, avoiding a full data scan.

Suggested approach by data tier:

A key trade-off to understand: retaining snapshots long-term accumulates storage costs, since every change adds another delta. Incremental backups are the most storage-efficient, but if a single incremental in the chain fails, the entire subsequent recovery chain can fail with it, which is why a regular full backup should always serve as an "anchor" for the incremental chain.

Ransomware Protection: The Role of Immutable Backup and Data Integrity Verification

CISA (US) recommends maintaining offline, encrypted backups of critical data and regularly testing their availability and integrity for disaster recovery; NIST CSRC offers similar guidance on implementing, maintaining, and testing backups to reduce ransomware impact.

A common failure point for SMEs is keeping backups on the same cloud account as the production environment if ransomware gains access, it can encrypt the backup along with everything else. This is not a hypothetical risk: in the first half of 2025, over 3 terabytes of data in Vietnam were encrypted in ransomware incidents, with reported data breaches up 21.4% year over year.

The 3-2-1-1-0 rule offers a simple framework for assessing your level of protection:

• 3 copies of your data
• on 2 different types of media
• with 1 copy stored offsite
• 1 copy kept offline or immutable (cannot be overwritten or deleted)
• 0 errors when restore is tested

Immutable backup applies a write-once, read-many policy — no one can delete or modify the data during the retention period. This is a critical safeguard if an administrator account is ever compromised.

Two of the most common mistakes SMEs make:

1. Having backups in place but never actually testing a restore - problems only surface when a real recovery is needed.
2. Keeping backups on the same subnet or account as production, while modern ransomware is fully capable of escalating privileges to reach backup storage as well.

Comparing Popular Cloud Backup Service Models

There are three main approaches SMEs typically consider when choosing a cloud backup service:

For Vietnamese SMEs, the three priorities that matter most in practice are: fast deployment without a large IT team, in-country data residency, and Vietnamese-language technical support when incidents occur.

Cost Drivers: The Hidden Factors Behind Cloud Backup Pricing for SMEs

Most SMEs focus only on "price per GB stored" when comparing cloud backup services — which is exactly why so many end up with unexpected bill shock a few months in.

There are four core cost components to account for:

1. Per-protected-instance fees Azure Backup, for example, charges a fixed fee per protected instance in addition to a separate storage charge (per Microsoft's public pricing page), protecting 20 servers means 20 separate instance fees, even if each server holds relatively little data.

2. Storage fees by GB and tier Azure Backup lists Standard LRS at $0.0224/GB, Standard GRS at $0.0448/GB, and Archive LRS at just $0.0027/GB, the archive tier is significantly cheaper but comes with much slower recovery times. Google Cloud Backup and DR uses a consumption-based model that separates storage charges from management charges.

3. Egress fees on restore Many providers charge for outbound data transfer during recovery, restoring 500 GB in an emergency can generate egress fees higher than an entire month of storage costs. Some regional providers, including GreenNode, price by actual GB/hour usage and don't charge for data transfer, removing this risk entirely.

4. Retention and archive fees The longer data must be retained for compliance, the more storage costs accumulate. However, moving data to an archive tier too early can push RTO beyond acceptable limits.

A practical cost estimation formula: total protected data volume × daily change rate (typically 3–10% for enterprise workloads) × retention period in days, plus any per-instance fees and estimated egress costs from testing a restore at least once a year.

How Often Should You Test Data Restore?

Regular restore testing is a legal obligation under Decree No. 333/2026/ND-CP (Article 6), not merely a best practice, the exact required frequency should be confirmed based on your system's assigned cybersecurity protection tier.

A restore testing checklist for SMEs:

• Select 1–2 of your most critical workloads to test, and restore into an isolated environment (never production)
• Measure actual recovery time against your RTO target, and verify data integrity (sample records, no missing files)
• Confirm the backup is free of malware before restoring it into a live environment
• Document results and timing, and update your recovery runbook if any gaps are found

As a reference point: test at least twice a year, and quarterly for Tier 1 data. Always keep documented results as compliance evidence for audits.

GreenNode's Cloud Backup and Recovery Solution for SMEs

GreenNode (formerly VNG Cloud) offers cloud data backup and recovery services (Backup Center) built for businesses that need enterprise-grade data protection without a large IT team.

What GreenNode delivers:

• Automated, scheduled snapshots for virtual servers (vServer), reducing dependence on manual processes
• Encryption for data at rest and in transit
• Role-based access control (RBAC) with comprehensive audit logging
• Usage-based GB/hour pricing with no data transfer fees, making costs predictable and eliminating surprise egress charges
• 24/7 infrastructure monitoring with a Vietnam-based support team, available in Vietnamese
• Infrastructure across multiple availability zones in Hanoi and Ho Chi Minh City, part of GreenNode's six-availability-zone network across Southeast Asia, meeting in-country data residency requirements

Three types of SMEs commonly rely on GreenNode for backup:

• Retail and F&B: POS, ERP, and HRM systems that require high uptime and fast recovery during peak sales hours. ACFC & VFBS runs nearly 300 stores across 25 brands, with 350+ active POS terminals on the GreenNode platform.
• Financial and professional services: contract data, customer records, and forms that require long-term retention matched to the applicable protection tier, with a clear audit trail.
• Omnichannel and CRM: reporting systems and cross-channel customer data that need consistent backups and the ability to restore to a specific point in time when data errors occur.

Explore GreenNode's customer stories or the Backup Center technical documentation to learn more about configuring snapshots, Server Disaster Recovery, and Veeam-based backup.

If you need help designing a backup policy around your organization's specific RPO/RTO requirements, GreenNode's team can provide direct consultation, this isn't just an off-the-shelf catalog service.

FAQ: What SMEs Should Ask Before Signing a Contract

Does cloud backup protect against ransomware?

Yes, provided the backup is isolated from the production environment, otherwise, ransomware with write access to backup storage can encrypt the backup as well. Ask providers about immutable backup and confirm backups are held on a separate account; standard cloud storage versioning isn't sufficient, since it can be deleted along with the original data.

How often should backups run?

It depends on each workload's RPO: critical POS/CRM systems should snapshot every 1–4 hours, internal file servers are typically fine with daily backups, and compliance archive data can be backed up weekly.

Are backups automated? Who monitors failures?

A good service should offer automated scheduling and alerts when a backup fails. SMEs without a dedicated IT team should choose a provider offering managed monitoring, and should clarify SLA response times for backup failures.

Is data stored within Vietnam?

This is a mandatory question for businesses in finance, healthcare, e-commerce, and any industry that processes personal data — see the legal framework section above for details. Ask providers directly: where is the data center located, and does data ever leave Vietnamese territory?