Practical guide · verified against the real thing
The 3-2-1 backup rule: why most people's 'backup' isn't actually one
In one line: Three copies, two different devices, one off site — and the honest reason the second and third numbers are the ones that save you.
Almost everyone believes they have a backup, and almost nobody does. What they have is a copy — on the same drive, in the same building, on the same account — and the day disaster arrives is precisely the day that distinction stops being pedantic. The 3-2-1 rule is the old photographer's discipline (popularised by Peter Krogh) that government agencies like CISA now recommend in their ransomware guidance, and it survives because every number in it defends against a different failure.
The rule, decoded
Three copies of your data — the original plus two backups. Two different devices or media — never both backups on the same drive, the same laptop's disk, or the same box. One copy off site — another building, or the cloud. The origin story is photography: professionals who could not re-shoot a wedding learned that house fires and stolen camera bags were a single-point-of-failure problem, not a carelessness problem. The same logic is why CISA's ransomware guidance asks for at least one offline or immutable copy: modern ransomware specifically hunts connected backups to delete them first, so the backup that saved you has to be one the malware can't reach.
Why your backup probably isn't one
The common non-backups, and what defeats each: the copy on the same external drive — dies with the drive it's on (theft, fire, ransomware, or the drive itself — drives are consumables). Time Machine or File History to a drive that's plugged in constantly — better, but it's in the same building and reachable when the computer is compromised. The cloud-sync folder — this is the big one, and the cloud-vs-local guide is dedicated to it: sync is not backup, because when you delete a file (or malware encrypts one), the deletion syncs faithfully to all your copies. "The cloud provider has my files" — that's one copy on someone else's hardware; it defends against a dead laptop and against almost nothing else.
What actually kills data
Ranked by how often it's the culprit rather than by drama: hardware failure (drives fail without warning, and phone storage is not exempt), human deletion (the file you deleted in March and noticed in June), theft and loss (phones especially — the frequency is worse than people assume), software corruption and failed updates, and malware. Notice that no single backup location defends against all five — which is the entire reason the rule has three numbers instead of one.
The 30-minute setup that satisfies the rule
For a normal household: copy one is your computer/phone as it lives. Copy two — an automatic, continuous backup to cloud backup software or your platform's backup system (iCloud Backup, Google One device backup — device backup, not just sync storage). Copy three — an external drive, backed up on a schedule you can tolerate (monthly is realistic; weekly is better), that lives unplugged in a drawer when it isn't working. That's 3-2-1: original + cloud + offline drive, two devices, one off site. Photos get special mention because they're the irreplaceable category — know which cloud you've trusted with them, and keep the drive copy anyway.
The test that proves it
A backup you've never restored is a hypothesis. Once, ever, try to restore something real — yesterday's version of a document, a photo, your phone onto a spare device. The restore is where backups fail (wrong app, forgotten password, sync-only copies), and finding that out on a quiet afternoon is the whole point. Backups aren't a thing you have; they're a thing you can prove work.
Sources: CISA StopRansomware guidance (multiple copies incl. offline/immutable); the 3-2-1 rule as popularised by Peter Krogh, The DAM Book. Reviewed September 2026.
Sources
Next