At the end of the day it is access to their files users want and if they get corrupted/deleted or just plain messed up they will be looking for you to get them back ASAP. You can build up how you protect your filesystems in layers, each giving you more protection and ease of restoration
I am going to assume you have put your files on a highly available storage either local or on a SAN and these disk are protected by the usual suspects of arranging the drives into RAID groups. If not then this would be the first layer of protection.
I would then be looking at implementing Volume Shadow Copy Snapshots on the drives. This technology allows you to schedule a snapshot of the drive you have the files on, then if a user deletes or saves a wrong version of a file, you can quickly revert to the snapshot copy. You can even get your users to do this meaning you don’t have to click a button, always a good thing.
For a file system I usually schedule a snapshot for midday and then at the end of the working day, but you can schedule them for whenever want and your users working patterns. This way if someone deletes something in the morning we can go back to the previous night and then in the afternoon back to midday. For a relatively something relatively simple to setup it can save the day for many users and make you a superstar as it only takes seconds to get their file back rather than going to a backup.
VSS is great way for getting a file back quickly, but if you lose the whole drive you are going to need a way of restoring those file and this is where an offsite backup is a must. This can be to tape/disk or to the cloud as long as you take a nightly copy each night off site. What the point of having a backup if the backup disk goes up in flames with the server.
For most small medium companies I would nowadays recommend a cloud backup solution as this will ensure that your data is automatically taken off site and you don’t have to worry about changing drives or tapes. This is dependent in your your internet bandwidth being good enough, but most companies will “pre-seed” the backup using a portable disk locally, that then gets sent back to provider to be copied onto the backup server. This means all they have to do now is copy the changes over the internet.
Some points I would check with the Online Backup Provider include:
How do they secure your data while copying and while on their server?, Is it encrypted?
Do they have a another copy of your data in another remote location?
Where is your data, is it kept in your your country.
How quickly can they can a restore of a complete disk to you?
Do they check that they can restore your data.
As you company grows it might be worth looking at DFS replication that will allow you to replicate a file & folder structure between servers, ensuring that is on server fails, users will be automatically be directed to another server that has a copy of the files and folders. Then ultimately you make want to look a cluster.
One option to keep in mind would be a Windows Storage Server, that will give you clustered storage solution for providing file shares and the added benefit of deduplication.