What the data shows
Verizon’s 2025 Data Breach Investigations Report found ransomware played a role in 44% of confirmed breaches investigated that year. CISA, the federal agency responsible for cybersecurity guidance, points to one specific defense as your best recovery path when it happens, a solid backup strategy. Recovery without one can take weeks or months, and CISA notes it may not be possible at all.
The agency’s recommended framework is simple enough to remember without writing it down, the 3-2-1 rule. Keep three copies of your data. Store them on two different types of media. Keep one copy off-site.
Why the number 3 and the number 2 both matter
A single backup sitting on the same network as your original files solves almost nothing. Ransomware hunts for backup files before it starts encrypting everything else, which means a backup one click away from your main system is often compromised in the same attack that hit your original data. Spreading copies across different media types, an external drive plus a cloud service, for instance, closes off a single point of failure. If one method fails or gets compromised, the others don’t share that weakness.
The off-site copy handles a different risk, the physical kind. A fire, a flood, a stolen laptop. None of those touch a copy sitting somewhere else.
The practical takeaway
For a household, this doesn’t require enterprise software. An external hard drive covers one media type. A cloud backup service, set to run on its own schedule rather than something you have to remember to trigger, covers the second and satisfies the off-site requirement in one step. The part people skip most often, and the part that matters most, is testing the restore. A backup you’ve never tried to recover from is a guess, not a plan. Once or twice a year, pull a file back from your backup and confirm it opens.
CISA’s more advanced guidance for organizations extends this to 3-2-1-1-0, adding an immutable copy that can’t be altered or deleted, and a zero-error standard on restore tests. For personal use, the original 3-2-1 rule still covers the overwhelming majority of real-world risk.
Reference
Cybersecurity and Infrastructure Security Agency. “Back Up Business Data.” https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/back-up-business-data
Top comments (0)