We back up to one USB disk attached to the server, is that enough?

No. A USB disk that's always plugged in isn't 3-2-1 and isn't air-gapped. Ransomware encrypts it too, fire burns it too. For a small SMB this is fixable in a few hours.

Try this first

1. 1Acknowledge the issue: 1 disk = 1 failure = data loss. Plus the disk lives 3-5 years before it fails, when did you last replace?
2. 2First fix, free to cheap: rotate 2 or 3 USB disks. Swap weekly, the inactive one goes home or to a different room. That alone gives air-gap for most threats.
3. 3Second fix: add automatic cloud backup alongside USB. Backblaze B2, Wasabi or Synology C2 on the NAS, so a 3rd copy lives offsite. Tens of euros monthly for SMB volumes.
4. 4Encrypt USB disks with BitLocker or LUKS. Recovery key in password manager, not on a sticker. A lost unencrypted disk is a notifiable GDPR breach.
5. 5Test restore quarterly from an offline-held disk. A disk nobody ever touches isn't backup, it's hope.
6. 6Document rotating disks with serial and purchase date. On failure you know which to replace.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.