The 3-2-1 Backup Rule: A Practical Guide for People and Small Teams

Most people discover their backup strategy on the worst day possible: the laptop won't boot, the phone fell in a lake, or someone deleted the shared folder. The good news is that a solid backup plan is not complicated. One simple rule covers most situations, and you can set it up in an afternoon.

What 3-2-1 means

The 3-2-1 rule is easy to remember:

• 3 copies of your data: the original plus two backups.
• 2 different types of storage, for example your laptop's internal drive and an external USB drive or a NAS.
• 1 copy offsite, somewhere physically separate: a cloud storage bucket, or a drive kept at a friend's house or the office.

Each number protects against a different failure. Three copies protect against a single drive dying. Two media types protect against one kind of failure taking out everything (a bad batch of disks, a firmware bug). One offsite copy protects against fire, flood, theft, and ransomware that encrypts everything plugged into your network.

Sync is not backup

This is the most common mistake. Cloud sync folders are convenient, but sync does exactly what you tell it to do — including the bad things. If you delete a file, sync deletes it everywhere. If ransomware encrypts your documents, sync happily uploads the encrypted versions.

A real backup has two properties sync often lacks:

1. History (versions). You can go back to how a file looked last Tuesday.
2. Separation. A mistake on your machine does not instantly change the backup.

Sync is fine as one of your copies, but it should not be the only one. Turn on version history if your service offers it, and keep at least one copy that is not live-mirrored.

A simple setup for individuals

You don't need enterprise tools. A practical personal setup:

• Copy 1: your working files on your computer.
• Copy 2: an external drive, backed up automatically every day or week (your OS's built-in backup tool works well).
• Copy 3: an encrypted offsite backup to cloud storage.

If you are comfortable with the command line, a tool like restic gives you encrypted, deduplicated snapshots with history:

# one-time: create an encrypted repository on an external drive
restic init --repo /Volumes/BackupDrive/restic

# daily: take a snapshot of your important folders
restic -r /Volumes/BackupDrive/restic backup ~/Documents ~/Pictures

# keep 7 daily, 4 weekly, 12 monthly snapshots
restic -r /Volumes/BackupDrive/restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --prune

Prefer something simpler? A plain dated copy works too:

rsync -a --delete ~/Documents/ /Volumes/BackupDrive/Documents-$(date +%F)/

Write down where the encryption password lives. An encrypted backup you can't unlock is not a backup.

A simple setup for a small team

For a team of 3–20 people, the same rule applies, just with a bit more structure:

• Pick a source of truth. Shared files live in one place (a file server, NAS, or shared drive), not scattered across laptops.
• Automate nightly snapshots of that source to a second device on-site.
• Push an encrypted copy offsite daily or weekly, ideally to storage where backups can't be deleted or overwritten for a set period (often called immutable or object-lock storage). This is your ransomware insurance.
• Back up the things people forget: databases (dump them first, then back up the dump), configuration files, password vault exports, and domain/DNS settings.
• Give one person ownership. "Everyone is responsible" means nobody checks.
• Limit who can delete backups. The account that runs daily work should not be able to wipe the backup history.

A monthly restore test checklist

A backup you have never restored is a hope, not a plan. Once a month, spend 20 minutes on this:

• [ ] Pick one random file and restore it from each backup copy.
• [ ] Open the restored file — don't just check that it exists.
• [ ] Check the date of the most recent backup. Is it as recent as you expect?
• [ ] Confirm the offsite copy is still being updated.
• [ ] Verify you can still find and use the encryption password or keys.
• [ ] Check free space on backup drives.
• [ ] Once a quarter, try restoring a whole folder (or for teams, a whole database) to a test location and time how long it takes.
• [ ] Write down anything that failed and fix it this week.

If you only do one thing after reading this: tonight, copy your most important folder to a second device and put today's date in the folder name. That's the first step toward 3-2-1.

Your turn

What does your backup setup look like today — and when was the last time you actually tested a restore?