Backups and the 3-2-1 rule
The safety net against ransomware, theft, broken phones and accidental deletion. How the 3-2-1 rule works, what to back up, and how to test that restore actually works.
Why backups are a security control
Antivirus tries to prevent bad things. Backups make sure you can recover when something bad happens anyway: ransomware, a stolen laptop, a phone dropped in water, a failed hard drive, or simply deleting the wrong folder. A tested backup turns a disaster into an inconvenience.
The 3-2-1 rule
A simple, widely used rule:
- 3 copies of your important data (the original plus two backups),
- on 2 different types of storage (for example your computer and an external drive or cloud),
- with 1 copy off-site (cloud storage, or a drive kept somewhere else).
Many professionals now add "-1-0": one copy that is offline or immutable (cannot be changed or deleted, even by an administrator, for a set period) and zero errors when you test a restore. The offline or immutable copy is what saves you if ransomware encrypts everything it can reach.
What to back up
| Priority | Examples |
|---|---|
| Irreplaceable | Photos, videos, personal documents, creative work |
| Hard to recreate | Tax records, scans of IDs and contracts, business files |
| Convenient | App settings, browser bookmarks, game saves |
| Usually not needed | Programs and the operating system (can be reinstalled) |
Also keep your password manager recovery kit and 2FA backup codes somewhere safe and separate.
Simple setups that work
For most households
- Turn on cloud backup on phones: iCloud Backup and iCloud Photos, or Google One backup and Google Photos.
- On computers, use OneDrive, iCloud Drive or Google Drive for your documents folder.
- Once a month, plug in an external drive and run File History (Windows) or Time Machine (Mac), then unplug it.
For a small business
- A business cloud backup service that keeps version history and supports immutable retention.
- A local backup (network storage or external drive) for fast restores.
- Backups of cloud services too: Microsoft 365 and Google Workspace data can be deleted or encrypted by an attacker with access. See backups and ransomware readiness.
Sync is not the same as backup. If a file is deleted or encrypted on your computer, sync may copy that change to the cloud. Make sure your service keeps version history or a recycle bin long enough to go back, typically 30 days or more.
Test your restore
A backup you have never restored from is a hope, not a plan. Every few months:
- Pick a few random files and restore them to a different folder.
- Open them and confirm they work.
- For businesses, time a full restore of one key system. Knowing it takes 9 hours is better than finding out during an incident.
Protect the backups themselves
- Use a strong unique password and 2FA on cloud backup accounts.
- Encrypt external drives (BitLocker on Windows, FileVault-formatted drives on Mac) so a lost drive does not leak your data.
- Keep at least one copy disconnected or immutable.
