NAS for a Small Office: Shared Storage with Proper Permissions

Accounts can open the HR folder. The only copy of last month's quote is on someone's desktop. The "shared drive" is a USB disk plugged into the director's PC, and it goes offline whenever that PC restarts for updates. If any of that sounds familiar, your office has outgrown ad-hoc file sharing.

The short answer: a NAS (network attached storage) gives a small office one fast, central place for files, with folders for each team and permissions that decide who can see, edit or only read each one. Set up properly, it also keeps earlier versions of files so a deletion or ransomware attack can be rolled back. Set up badly, it becomes one more box in the cupboard that everyone can see into and nobody looks after.

This guide covers how we plan a NAS for offices of roughly 3 to 50 people: the hardware, the RAID layout, the folder and permission design, remote access, and the backup that has to sit behind it.

When a NAS makes more sense than the cloud

Microsoft 365 and SharePoint are the right home for a lot of office files, especially when staff work from home. But some offices genuinely need local storage. A NAS is usually the better fit when:

• The files are big. CAD drawings, Revit models, photography, video and scanned archives open far faster over the office network than over broadband. Architects and engineers feel this every day, which is why we often pair a NAS with cloud storage for architecture and engineering firms.
• The broadband upload is slow. Syncing hundreds of gigabytes to the cloud over a modest upload speed can take days and slow everyone else's internet while it runs.
• Software needs a mapped drive. Some accounts, practice management and design packages expect their data on a network share with a drive letter, not in a cloud sync folder.
• You want a one-off cost. A NAS is bought once. Cloud storage is a monthly cost per user or per terabyte.

Plenty of offices end up with both: active project files on the NAS, finished documents and email in Microsoft 365, and the NAS backed up to the cloud. If most of your team works remotely, read our guide on moving a file server or NAS to SharePoint before buying hardware.

Choosing the hardware

How many drive bays?

A 2-bay NAS mirrors two drives. It is simple and fine for a few people with modest storage. A 4-bay NAS is the sweet spot for most small offices because it allows RAID 6 or Synology SHR-2, which survive two drive failures, and leaves room to grow. Larger offices or heavy media users may want 6 or 8 bays.

Synology or QNAP?

Both make good small business NAS units. Synology's DSM software is the easier one to live with day to day, and its tools for snapshots, backup and file sync are well integrated. QNAP often gives more hardware for the money, such as faster network ports. We install both. For most offices without an in-house IT person, we lean towards Synology because it is easier to keep tidy.

Use NAS-rated drives

Buy drives designed to run all day in a NAS, such as Seagate IronWolf or WD Red Plus. Avoid desktop drives and check the drive uses CMR recording rather than SMR. SMR drives can rebuild very slowly in RAID, which leaves the array exposed for longer after a failure.

Add a UPS

A small uninterruptible power supply keeps the NAS running through a brief power cut and tells it to shut down cleanly during a long one. Sudden power loss is a common cause of corrupted volumes, and a UPS is cheap insurance.

Picking the RAID layout

RAID spreads your data across several drives so the NAS keeps working when one fails. The trade-off is space: some of the raw capacity goes on protection. Our RAID calculator shows exactly how much usable space you will get for your drives and how many can fail.

• 2 drives: RAID 1 or SHR-1 (a mirror). You get the space of one drive.
• 4 or more drives with important work files: RAID 6 or SHR-2. You lose two drives of space, but a second failure during a rebuild does not wipe the volume.
• Mixed drive sizes: Synology SHR uses them far better than standard RAID, which treats every drive as if it were the smallest.

Remember that RAID is not a backup. It protects against a dead drive, not against deleted folders, ransomware, theft or fire. We come back to this below.

Designing folders and permissions

This is the part that is most often skipped, and it is where the real value is. Good permissions mean people find files quickly and only see what they should.

Start from teams, not people

Create one shared folder per team or function, for example Directors, Accounts, HR, Sales, Projects and a Company folder everyone can read. Then create a group for each team on the NAS and give permissions to the groups, never to individual users. When someone joins Accounts, you add them to the Accounts group and they get everything they need. When they leave, you remove them once.

An example layout

Shared folder	Directors	Accounts	Sales	All staff
Company (policies, templates)	Edit	Read	Read	Read
Accounts	Edit	Edit	No access	No access
HR	Edit	No access	No access	No access
Sales	Edit	Read	Edit	No access
Projects	Edit	Read	Edit	Read

Your structure will differ, but the principle is the same: a small number of top-level folders, each with a clear owner, and access granted to groups.

Keep permissions at the top level

Set permissions on the shared folders themselves and let subfolders inherit them. Special permissions on individual subfolders are the reason old file servers become impossible to manage. If one subfolder needs different access, it usually wants to be its own shared folder.

Turn on the recycle bin and snapshots

Each shared folder can have its own recycle bin, which catches most accidental deletions. Snapshots go further. On a Synology NAS with the Btrfs file system, Snapshot Replication takes point-in-time copies of a shared folder every hour or every day. If ransomware encrypts the files, you roll the folder back to the snapshot from before the attack. Recent DSM versions can also make snapshots immutable for a set period, so even an attacker with an admin password cannot delete them.

Local accounts or a directory?

For most small offices, users and groups created on the NAS itself are fine. If you already run Windows Server with Active Directory, the NAS can join the domain so staff sign in with their usual Windows account. We decide this based on how you manage logins today.

Remote access without opening the door to attackers

Internet-facing NAS units are a favourite target. In 2022 the DeadBolt ransomware campaign encrypted QNAP devices that were reachable directly from the internet. The safe rules are simple:

• Never forward the NAS admin page through your router.
• Use a VPN for staff who need the mapped drive from home. A business router or firewall such as Ubiquiti UniFi can provide this.
• Turn on two-factor sign-in for every NAS admin account and disable the default admin account.
• Keep DSM or QTS updated, and switch on automatic security updates.

If remote access is the main need, a sync tool such as Synology Drive or a move to SharePoint may suit your team better than a VPN. We will talk through which fits how your staff work.

The backup behind the NAS

A NAS holding the only copy of your business files needs its own backup. The well-known 3-2-1 rule is a good target: three copies of your data, on two different types of storage, with one copy off site. In practice that is the live NAS, snapshots on the NAS, and a versioned, encrypted backup in the cloud. Our guide on backing up a NAS to the cloud walks through the options, and our business backup service can set it up and check it for you.

Looking after it

• Email alerts for drive warnings, failed backups and low space, sent to someone who will act on them.
• Drive health checks scheduled monthly, so a failing drive is replaced before it dies.
• A quarterly look at who has access to what, especially after staff changes.
• A test restore every few months, because a backup you have never restored is a hope, not a plan.

How we set up a NAS for an office

We start by looking at what you have: where files live now, how big they are, who needs what, and how people work from home. We explain what we find and recommend the NAS, drives and RAID layout. Once you agree, we install it, build the folders and permissions, move your files across, map drives on every PC and set up snapshots and the cloud backup. Before we leave, we test a restore with you and write down how it is set up.

If you would like a hand, our network and storage team covers offices across London, Berkshire and Surrey. If you are still deciding whether you need a NAS at all, our earlier guide on why small businesses use a NAS covers the basics.

Frequently Asked Questions

Is a NAS better than Microsoft 365 for file storage?

It depends on the files and the team. A NAS is faster for large files and works without the internet. SharePoint and OneDrive are better for remote work and sharing with clients. Many offices use both, with the NAS backed up to the cloud.

How much storage does a small office need?

Measure what you have now, then allow for at least three years of growth and the space RAID protection takes. Our RAID calculator shows the usable space for any set of drives.

Can different staff see different folders on a NAS?

Yes. You create groups for each team and give each group edit, read-only or no access to each shared folder. Staff only see the folders they are allowed to open.

Does a NAS protect against ransomware?

Not on its own. Snapshots, especially immutable ones, let you roll files back after an attack, and an off-site cloud backup protects you if the NAS itself is hit. Keeping the NAS off the open internet matters just as much.

Can you set up a NAS we already own?

Yes. We often take over an existing Synology or QNAP, tidy up the permissions, update the software, turn on snapshots and add a proper backup.