Three copies, two different media, one offsite. Simple, boring, and what saves you the day a drive dies, a burglar hits, or ransomware strikes.
Everything's fine... until the laptop drive fails, ransomware encrypts your files, or a water leak finishes the job. Backups are the insurance policy you thank once.
The 3-2-1 rule comes from the photography world (Peter Krogh, The DAM Book, 2005), and has since been adopted by several cybersecurity agencies, including CISA in the United States. Here's how to apply it without losing a weekend.
The rule in three lines
- 3 copies of your data (original + 2 backups)
- 2 different media (internal disk + external disk, or disk + cloud)
- 1 copy offsite (at a friend's, at the office, or in the cloud)
You need three problems at once to lose your data. That almost never happens.
A concrete example for a family
| Copy | Where | How |
|---|---|---|
| Original | On your computer | Your everyday files |
| Backup 1 | External drive at home | Time Machine (Mac) or File History (Windows), automatic |
| Backup 2 | Cloud (iCloud, OneDrive, Google Drive, Proton Drive, Backblaze) | Automatic, offsite |
Ballpark cost: a 2 TB external drive around $100, and a cloud subscription for the files that matter between $30 and $60 per year depending on space. Check prices when you buy; they shift.
What it actually protects against
- Hardware failure (the most common): the external drive and the cloud keep everything
- Theft or fire: the cloud saves the day
- Human error (deleted file, overwritten): the cloud and Time Machine keep history
- Ransomware: only an offline or off-account copy stays clean. That's why separate media matter, and why unplugging the external drive after a backup is a good habit.
The common trap: sync is not backup
iCloud, Dropbox, OneDrive sync. They don't back up. If you delete a file, it disappears everywhere. A real backup tool keeps versions and lets you rewind.
Check that your service keeps real history (30 to 90 days minimum) and doesn't just overwrite on every change. If it doesn't, add a real backup tool on top.
One Sunday, two hours, peace of mind
Plug in an external drive (2 TB, around $100), turn on your system's automatic backup (Time Machine on Mac, File History on Windows), then pick a cloud service for the files that truly matter (Photos, Documents). Once the first backup completes, unplug the external drive and put it away: that's what keeps it safe from ransomware hitting a computer that's always powered on.
Three months from now, add to your calendar: "test a restore". Pull a random file back from each copy, verify it opens. Without that test, you have a belief, not a backup.
Backups are the safety net. Good habits upstream (unique passwords, MFA, skepticism about emails) prevent most disasters: see cybersecurity is everyone's responsibility and how to build a security-first culture.
A backup strategy for a small business, with documented restore tests and named owners, is more than one external drive. Book thirty minutes and we'll figure out where to start.