The 3-2-1 backup rule, explained

The 3-2-1 backup rule is a simple, widely recommended way to make sure you never lose data you care about. It's been used by IT teams and photographers for years because it protects against almost every common cause of data loss with one easy-to-remember formula.

What the 3-2-1 rule means

3 copies of your data

Keep your original data plus at least two backups. If one backup is damaged or out of date, you still have another. Two backups failing at the same time is far less likely than one.

2 different types of storage

Store your copies on at least two different kinds of storage, for example your computer's internal drive and an external drive, or a NAS and the cloud. Different devices fail in different ways, so spreading copies across them lowers the chance of losing everything at once.

1 copy offsite

Keep at least one copy in a different physical location. Fire, flood, theft, or a power surge can destroy every device in a home or office. An offsite copy, most often a cloud backup, survives whatever happens to the original location.

Why the 3-2-1 rule works

Each part of the rule covers a different risk:

• Multiple copies protect against a single backup failing or being corrupted.
• Multiple media protect against a device, drive model, or storage system failing.
• Offsite storage protects against local disasters, theft, and anything that hits one building.

3-2-1 examples

For home users

• Copy 1: the files on your laptop or desktop.
• Copy 2: an automatic backup to an external drive (for example with your operating system's built-in backup tool).
• Copy 3: a cloud backup service that continuously backs up your computer offsite.

For small businesses

• Copy 1: data on employee computers, servers, and business apps.
• Copy 2: local backups to a NAS or backup appliance for fast restores.
• Copy 3: a cloud or offsite backup, ideally with immutable storage so it can't be altered.

Our small business backup plan guide covers how to set this up step by step.

Beyond 3-2-1: the 3-2-1-1-0 rule

Ransomware changed the backup picture. Attackers often try to find and destroy backups before encrypting the rest of a network. That's led many security teams to recommend an extended version, often called 3-2-1-1-0:

• 1 copy that is offline, air-gapped, or immutable, meaning it can't be changed or deleted for a set time.
• 0 errors, confirmed by regularly testing that your backups restore correctly.

Read more in how to protect your backups from ransomware.

Common 3-2-1 mistakes

• Keeping the external drive plugged in all the time. It's convenient, but ransomware or a power surge can reach it too.
• Treating file sync as a backup. Sync services copy deletions and corruption to every device. See cloud backup vs. cloud storage.
• Never testing a restore. A backup you can't restore from isn't really a backup.
• Forgetting cloud apps. Email and files in services like Microsoft 365 or Google Workspace need their own backup.

The easiest way to get the offsite copy

For most people, the hardest part of 3-2-1 is the offsite copy. Carrying drives to another location is easy to forget. A cloud backup service handles it automatically, in the background, every day. Use our cloud backup checklist to compare options.