The 3-2-1 Backup Rule for Home Offices and Small Businesses: A Practical Setup
Note: Some future links on this site may be affiliate links. We never claim hands-on testing; guides are researched from the public sources listed in each article.
How we wrote this: A setup guide based on guidance from the Cybersecurity and Infrastructure Security Agency (CISA) and Backblaze (linked below). We have not tested any backup product. Follow your operating system's and vendor's instructions for your setup.
Drives fail, laptops get stolen and ransomware happens. The 3-2-1 rule is the simplest backup plan that survives all three.
The rule
CISA's Data Backup Options puts it this way:
- 3: keep 3 copies of any important file: 1 primary and 2 backups.
- 2: keep the files on 2 different types of media, so one problem can't wipe out both.
- 1: store 1 copy offsite, outside your home or business.
Backblaze's explainer gives the same definition and calls the rule the de facto standard for data redundancy.
A simple setup most people can manage
| Copy | Where | How |
|---|---|---|
| 1 (primary) | Your computer | Where you work every day |
| 2 (local backup) | External drive or a network storage box | Automatic backups with your OS tool (Time Machine on Mac, File History or a backup app on Windows) |
| 3 (offsite) | Cloud backup service, or a second drive kept elsewhere | Continuous cloud backup, or swap drives regularly |
What to look for: (Look for: external USB hard drive for computer backup, at least twice your data size)
Cloud sync isn't backup. Sync services mirror deletions and encrypted files. CISA notes that cloud storage can protect against local disasters and device failures. Choose a service or setting that keeps previous versions so you can roll back.
Protecting against ransomware
- Keep at least one copy disconnected or versioned, so malware that encrypts your computer can't encrypt every backup too.
- Use a strong, unique password and two-factor sign-in on your cloud backup account.
- Update your computer and backup software.
Test your restore
A backup you've never restored is a hope, not a plan. Every few months:
- Pick a few random files and restore them to a different folder.
- Open them to confirm they're intact.
- Check the backup's "last completed" date.
For small offices
- Back up shared drives and line-of-business data, not just laptops.
- Document who checks backups and how often.
- Consider how long you could operate without your data. That tells you how quickly you need to restore, and whether a local copy is essential.