Backups That Actually Work: The 3-2-1 Rule

Why backups matter

Drives fail, laptops are lost or stolen, files get deleted or overwritten, and ransomware can encrypt everything in minutes. A good backup turns all of these from a disaster into an inconvenience.

The 3-2-1 rule

The 3-2-1 rule is a simple, widely recommended standard:

• 3 copies of your data: the original plus two backups.
• 2 different types of storage, for example your computer's drive and an external drive or NAS.
• 1 copy off-site, for example an encrypted cloud backup, so a fire, flood or theft can't take everything.

Many people add one more step: keep one copy offline or immutable (it can't be changed), which protects against ransomware reaching your backups too.

Sync is not backup

Services like OneDrive, iCloud Drive, Dropbox and Google Drive sync your files: change or delete a file on one device and the change appears everywhere. That's convenient, but it also means accidental deletions and ransomware-encrypted files sync too.

Version history and recycle bins help, but they have limits. A true backup is a separate copy, kept with history, that you can restore from a point in time.

A simple backup plan

For home users

1. Turn on your computer's built-in backup: File History or a backup tool on Windows, Time Machine on a Mac, to an external drive.
2. Add an automatic cloud backup service for an off-site copy.
3. Make sure your phone backs up photos and data to the cloud.

For small businesses

1. Automated, scheduled backups of every computer and server to local storage, such as a NAS.
2. Encrypted off-site or cloud backup with version history.
3. A backup for Microsoft 365 or Google Workspace data (email, files) if it's business-critical.
4. A written plan for who restores what, and in what order, after an incident.

Test your restores

A backup you've never restored from is a hope, not a plan. Every few months:

• Restore a few random files and open them.
• Check the backup log for errors or warnings.
• Confirm the newest backup is recent.
• For businesses, occasionally test a full system restore.

Extra tips

• Encrypt backups, especially external drives that could be lost.
• Unplug external backup drives when not in use, or rotate two drives, so ransomware can't reach them.
• Replace backup drives every few years; they wear out too.
• Don't forget data outside "Documents": desktop files, email archives, browser bookmarks and accounting files.