The 3-2-1 Backup Rule Explained
Learn how the 3-2-1 backup rule reduces the risk of hardware failure, theft, ransomware and accidental deletion.
The 3-2-1 backup rule is a practical way to avoid depending on one device, one technology or one location. It calls for three copies of important data, stored on two different types of media, with one copy kept offsite.
The original working data counts as one copy. A local external drive or network device can provide the second, while an encrypted cloud backup provides the offsite third copy. CISA describes 3-2-1 as a trusted backup guideline and recommends regular backups as protection against ransomware and malware.
What each number means
| Rule | Meaning | Example |
|---|---|---|
| 3 copies | The working data plus two independent backups | Laptop, USB drive and cloud backup |
| 2 media types | Avoid putting every copy on the same technology | Internal storage plus external disk or NAS |
| 1 offsite copy | Keep one recovery copy away from the original location | Encrypted cloud backup |
Why one backup is not enough
An external drive can fail, be stolen with the computer, or remain connected when ransomware strikes. A cloud account can also be misconfigured, inaccessible or affected by compromised credentials. Independent copies reduce the chance that one event destroys every recovery route.
A sensible home setup
- Keep active files on the computer.
- Run an automatic local backup to an external drive.
- Use a dedicated cloud-backup service for an offsite copy.
- Disconnect or otherwise protect the local backup when it is not running.
- Test representative restores from both destinations.
For one main computer, our Backblaze vs IDrive comparison explains the trade-off between unlimited per-computer backup and a shared multi-device allowance.
A small-business implementation
Businesses should begin with an inventory of endpoints, servers, cloud applications and critical records. Assign an owner, define backup frequency and retention, protect administrator accounts with multi-factor authentication and document the recovery order. A backup plan is not complete until responsibility and testing are clear.
3-2-1-1-0 and modern variations
Some organisations extend the rule to 3-2-1-1-0: three copies, two media types, one offsite copy, one offline or immutable copy, and zero unverified backup errors. The extra controls are particularly useful where ransomware or regulated data is a concern. They do not replace the original rule; they strengthen it.
Common mistakes
- Counting synchronised folders as the only backup.
- Leaving the external backup permanently attached and writable.
- Using the same administrator credentials for production and backup.
- Ignoring deleted-file and version-retention limits.
- Never testing whether files can actually be restored.
How often should copies run?
Frequency should reflect how much work you can afford to lose. Personal documents may need daily protection; frequently changing business data may require continuous or much shorter intervals. The local and cloud copies do not have to run identically, but both need monitoring.
Continue learning: see how to protect external hard drives in the cloud and keep backups recoverable during ransomware.
Frequently asked questions
Does RAID count as a backup?
RAID can improve availability after a disk failure, but it does not protect against deletion, corruption, theft or ransomware and should not be treated as a separate backup.
Is cloud backup automatically the offsite copy?
Usually, provided the cloud copy is independent of the original system and protected by appropriate access controls and retention.
Do the two media types have to be completely different?
The objective is to avoid a shared failure mode. A local disk plus a separately operated cloud repository is a practical interpretation for most homes and small businesses.
How often should restores be tested?
Test after setup and periodically thereafter. Businesses should also test after major system, provider or policy changes.