Tier 1 vendor is not a guarantee of anything. If you do not have actual possession of your data (in at least two different places, as sfx2000 also suggests), then you simply have misplaced faith that hopefully won't turn into a nightmare for you (but it can).
'Cloud' is the definition of 'control by others'. That is the position I don't place myself or my customers in.
I understand the "warm 'n fuzzy" about being able to "see/touch" your server, or NAS, or whatever for storage.
However, on the flip side, many people, residential users, especially even more..small to medium business owners, mistakenly assume that they have "control" of their network. Just because you can "see" your server, or see your NAS on the network that you're storing or backing up to, doesn't mean your data is secure. Way over 99% of those have networks that are compromised. Their data "really isn't secure". Sure there's the well known stuff like various crypto-ware, but the majority of "bad" stuff is what sits on end users computers..that they do not know about. The amount of actual "spyware" that sits in stealth, gathering intel, uploading what it finds, is staggering. This isn't tin foil hat stuff anymore, it's incredibly serious, and incredibly widespread. The larger majority of SMB clients don't have the budget or resources to have an IT department that fully manages their network. Most just have plain NAT routers and traditional antivirus like symantsuck or mcrapee. Even those with UTM appliances at the edge, don't sit there and investigate the logs of in/out traffic closely, and take actions based on findings.
I'm old school IT...learned computers from the early days of working with punch cards, to cassettes, to true floppies, to 3.5" floppies, DOS, Win3, Artisoft networking, NT 3.5 and 4..and on up. So cloud storage is was a "leap in faith" for me. But I'm not going to pretend just keeping things local is by default safer than tier-1 cloud. The better cloud services have the resources to properly secure their data centers, keeping them constantly monitored, updated, hardware refreshes, etc. As well as...much higher security than home grown can afford.
2x levels of backup....yup, agree with that. We focus on DattoBackup for our clients...the best of the best of the best for disaster recovery/business continuity., so we have both local, and offsite. Offsite being spread across east and west coast of the US...redundant.
Keeping everything literally locally, in-house...not really good. Just ask people that lived through floods or fires how well that went for them.
For those people that raise their hand and say "But...I also take my backups offsite, rotate media". I've seen that fail a lot. Repeat.."a lot". Improper handling (just toss it in the purse next to the cell phone, or toss in glove box, heat, bumps...I've stumbled across lost of corrupted restore media), or not encrypt that backup media (can get lost/stolen), or of course human nature..."I forgot!" Often heard someone say.."crap..I forgot a while ago"..and as we investigate..that "last time" they swapped backup media was 6 or 9 months ago or much longer. I still vividly remember not long ago, having to tell 1 client that they lost all their data when the RAID broke on their server, and I asked her for her backup and she started to pause..then panic...admitting it was over a year ago she did it. She fell to her knees of the office floor when she realized how much Quickbooks data was lost.
I do not want any clients that will "do their own backup". Because I know, leaving it to human nature, it won't get done. our MSP clients get managed backup, backups we monitor each day, and frequently test.
