The 3-2-1 Backup Rule, Explained for Home and Small-Office Users

The 3-2-1 backup rule says you should keep three copies of important data, on two different types of storage, with one copy kept off-site. It has been around for years because it works: no single failure, whether a dead hard drive, a burst pipe or a ransomware infection, can wipe out every copy at once.

What each number protects you from

• Three copies means your original plus two backups. If one backup turns out to be corrupted when you need it, you still have another.
• Two types of storage means not keeping everything on identical drives bought on the same day. Different media fail in different ways; a laptop's internal SSD plus an external drive, or a network drive plus cloud storage, are typical pairs.
• One off-site copy protects against fire, flood and theft, which take out everything in the same building.

Many people now add a fourth idea: keep one copy offline or immutable. Ransomware encrypts every drive it can reach, including an external disk that is permanently plugged in or a synced folder that faithfully copies the encrypted files. A backup that is disconnected, or one stored with versioning that cannot be overwritten, survives. CISA's guide to data backup options walks through the trade-offs of each storage type.

Sync is not backup

This is the misunderstanding that causes the most lost data. Services like OneDrive, Google Drive, iCloud Drive and Dropbox sync files: delete or corrupt a file on your laptop, and that change is copied everywhere within seconds. Sync is excellent for working across devices, but it only counts as a backup if it keeps version history and deleted files for long enough to recover from a mistake you notice a week later. Check your plan's retention period before you rely on it.

A simple 3-2-1 setup for a household

1. Copy 1, the original: files on your computer and phone.
2. Copy 2, local backup: an external drive using the backup tool built into your operating system (File History or Windows Backup on Windows, Time Machine on macOS). Plug it in weekly, let it run, then unplug it.
3. Copy 3, off-site: a cloud backup service, or a cloud storage plan with version history switched on. Photos and documents are the priority.

A simple 3-2-1 setup for a small office

1. Originals on staff laptops and a shared drive or cloud workspace.
2. Local backup to a network storage device (NAS) with snapshots enabled, so earlier versions cannot be overwritten by a single infected laptop.
3. Off-site backup from the NAS or workspace to a separate cloud backup provider, ideally with immutable or locked retention.
4. Separate credentials: the account that manages backups should not be the same one people use for daily work, and it should have two-factor authentication. See our guide on setting up two-factor authentication.

What to back up

• Documents, spreadsheets and anything you created yourself
• Photos and videos, which are irreplaceable and often the largest folder
• Accounting files, invoices and records you are legally required to keep
• Email, if it is stored only on your computer
• A list of installed software and licence keys, so rebuilding a machine is quick

You usually do not need to back up the operating system or applications themselves if you can reinstall them, but a full system image is convenient for a business machine that must be back online quickly.

How often?

Ask how much work you could stand to redo. If losing a day of changes would hurt, back up daily. Automatic backups beat manual ones, because manual backups stop happening the first busy week.

The step most people skip: test a restore

A backup you have never restored from is a hope, not a plan. Once a quarter:

• Pick a random file from a few weeks ago and restore it from each backup copy.
• Open it and confirm it is intact.
• Write down how long the full restore of a computer would take. If the answer is "I do not know", find out before you need it.

Checklist

• Three copies, two kinds of storage, one off-site
• At least one copy offline or protected by version history
• Backups run automatically
• Restore tested in the last three months