3-2-1: three copies, two kinds, one off-site
The 3-2-1 rule — coined by photographer Peter Krogh and now recommended by the federal cybersecurity agency CISA — survives every common disaster because no single event can take all three copies. Here is how to build it without becoming an IT person.
Know what you are protecting against
Big-fleet data from cloud storage operators shows around 1.4% of hard drives fail each year — about one in seventy, in air-conditioned data centers. Consumer drives in hot offices and garages do worse. Add theft, ransomware, spilled coffee and the classic “deleted the wrong folder,” and the question is never if you will need a backup — only whether one exists when you do.
Copy one: an external drive + the free built-in tool
A portable drive is around $65 for 2TB, and the software is already on your machine: File History on Windows, Time Machine on Mac. Plug it in, turn it on, and it quietly keeps versioned copies. That covers the everyday disasters — but a drive sitting next to the computer burns, floods and gets stolen with it.
Copy two: real cloud backup (not sync!)
This is the off-site copy. True backup services run around $99 a year for unlimited data on one computer, with budget tiers from a few dollars a month. Crucially, sync is not backup: OneDrive, Google Drive and iCloud mirror your folder, so a deletion — or ransomware encryption — syncs everywhere in seconds, and recycle bins only hold so long. A backup service keeps its own history no matter what happens to the computer.
Do not forget the phone
Your photos probably live on one device in your pocket. Turn on iCloud Photos or Google Photos — enough space is around $1–$3 a month — and remember that is still one copy in one ecosystem: once or twice a year, export the library to your computer so it lands in the backups above.
Test the restore — twice a year
A backup you have never restored from is a hope, not a plan. Every few months, pull back two or three files from the drive and from the cloud and open them. Thirty seconds, and now you know — because the worst time to discover a backup was silently broken is the day you need it.
Ransomware is why one copy stays offline
If you run a business, the stakes change: modern ransomware does not just encrypt the computer it lands on — it hunts for connected backups and encrypts those too, precisely so you have to pay. The recent industry numbers are blunt: in the latest major survey, nearly half of hit companies paid the ransom, and only about half successfully restored from their backups — the rest found out too late that their backup was connected, incomplete or broken. That is why the modern version of the rule adds a digit: 3-2-1-1-0 — one additional copy offline or immutable (a drive that gets unplugged, or cloud storage that cannot be altered once written), and zero errors on your restore tests. For a small Bakersfield business that can be as simple as two rotating drives where one always lives disconnected, or a cloud plan with immutability turned on — plus a quarterly ten-minute restore drill. It is unglamorous, and it is the difference between a bad Tuesday and a closed business. We set this up as part of our IT service work: sized to what you actually have, automated so nobody has to remember it, and tested on a schedule so it provably works.
Did this guide help?
One tap, no sign-up — it tells us which guides to improve and shows the next reader what worked.
We build the backup, automate it, and test it with you
Drive, cloud, schedule, and for businesses the offline copy ransomware cannot reach — configured, automated and verified with a real restore before we leave. Then it just runs.
More guides: IT services for business · Repair or replace? · Avoid tech-support scams
Quick answers
What’s 3-2-1 in plain English?
Three copies, two kinds of storage, one off-site: your computer, an external drive, and a cloud backup. No single disaster gets all three.
Isn’t my stuff already in OneDrive/Google Drive?
That’s sync, not backup — deletions and ransomware sync too, everywhere, in seconds. A real backup keeps independent version history.
What does it cost?
Around $65 once for a drive (software is free and built in) plus around $99 a year for unlimited cloud backup. Phone photos: around $1–$3 a month.
How do I know it’s working?
Restore a few files every few months and open them. Thirty seconds. A backup you’ve never restored from is a hope, not a plan.