The 3-2-1 Backup Rule, Simply

The rule in one minute

• 3 copies of anything irreplaceable: the original on your computer or phone, plus two backups.
• 2 different kinds of storage, for example your internal drive and an external drive, so a single failure mode (a bad batch of drives, a software bug, a power surge) cannot take both.
• 1 copy offsite: cloud storage, or a drive at a relative's house, so fire, flood, or burglary cannot take everything at once.

Two additions turn a 1990s rule into a 2026 one. First, at least one copy must be offline or versioned. CISA's ransomware guide is blunt about why: many ransomware variants "attempt to find and subsequently delete or encrypt accessible backups to make restoration impossible unless the ransom is paid." A drive that is always plugged in is not a backup against ransomware; it is a third copy for the criminals. Second, test the restore. CISA and NIST both say to test regularly. A backup you have never restored from is a hope, not a plan.

Why this is the defense that matters

Every other security step lowers the odds of a bad day. A backup decides what the bad day costs. In Sophos's 2026 ransomware survey, 66 percent of victims recovered their data from backups, up from 54 percent the year before, and the share paying a ransom fell to 48 percent. The average recovery bill for organizations was $1.7 million; for a household with a tested backup it is an afternoon and the price of a coffee. Drives also simply die, phones get dropped in lakes, and laptops leave the back seat of cars. The rule covers all of it with one setup.

The backup plan table

Pick the row that matches what you are protecting. Prices are U.S. list prices read on the vendors' pages on September 21, 2026. Hard drive prices move with the market; in 2026 reviewers at PCMag and Tom's Guide put 1 TB portable drives under $50 and 4 TB portable drives under $100.

The built-in tools you already own

The afternoon setup

1. Decide what is irreplaceable (10 min). Photos, documents, tax and medical records, the family video folder, the password manager export. Everything else can be re-downloaded.
2. Buy or find an external drive (5 min, plus shipping). For a whole-computer backup, at least twice your computer's storage. For documents alone, anything works. Label it with the date.
3. Turn on the local backup (15 min). Time Machine or File History, with encryption on. Let the first run finish; it can take hours for a full machine, and later runs are quick because only changes are copied.
4. Turn on the offsite copy (15 min). Cloud photo library for the phone, a versioned cloud folder for documents, or Backblaze for the whole computer. Confirm the plan has enough space and keeps versions.
5. Unplug the drive (1 min). Put it in a drawer. Plug it in weekly, let it run, unplug it again. Some people buy two drives and keep one at a relative's house, swapping monthly; that is 3-2-1 with no subscription.
6. Run the restore test (20 min). Pick one photo and one document. Delete each from your computer (move it to the trash first if you are nervous). Restore the photo from the drive and the document from the cloud. Open both. If either fails, you have found the problem on a good day instead of a bad one.
7. Put two reminders in your calendar (2 min). Weekly: plug in the drive. Quarterly: restore one file from each copy.

Why this beats ransomware

Ransomware encrypts every drive it can reach, including the always-connected USB backup and, through sync, your cloud folder. What survives is the drive in the drawer and the versions the cloud service kept. Recovery becomes wipe, reinstall, restore, change passwords, over an afternoon, instead of paying criminals or losing years of photos. The ransomware guide walks through the first hour if it ever happens.

Mistakes that quietly break backups

• Leaving the drive plugged in. Convenient, and exactly what the malware hopes for.
• Trusting sync as backup. Sync copies your mistakes and your infections. Version history is the part that protects you.
• Never restoring. Drives fail silently, backup software gets turned off by an update, cloud plans fill up. A quarterly restore catches all three.
• One drive for ten years. Replace the backup drive every three to five years, or when it starts making noise.
• Backing up the phone only to the computer. If the laptop and the phone share a bag, one theft takes both.