The 3-2-1 backup rule, and how to actually do it in 2026

Plug an external drive into a laptop, drag your photos across, leave it plugged in. That is what most people call a backup. Ransomware calls it a second target, because anything your computer can write to, malware running on your computer can encrypt.

The 3-2-1 backup rule exists to close that gap, and it has survived twenty years of changing hardware because it is about topology rather than technology.

What the 3-2-1 backup rule actually means

Three numbers, one sentence each.

• Three copies of your data. The live copy you work on, plus two backups. Not one. Two, because backups fail, and they tend to fail silently.
• Two different types of media. An internal SSD and an external SSD are one type wearing two hats. A drive plus a network share, or a drive plus cloud storage, is two.
• One copy offsite. Somewhere a flood, a fire or a burglary at your address cannot reach. Cloud counts. So does a drive at a relative's house, if you actually rotate it.

The logic is that each number defends against a different failure. Three copies handles hardware death. Two media types handles a shared flaw, like a bad batch of drives or a filesystem bug. One offsite handles everything that takes out the whole building.

How to build it in 2026

Copy one: the fast local backup

An external SSD for the things you would miss within an hour of losing them. Speed matters here because a backup you have to schedule around is a backup you eventually stop running. The Samsung T7 1TB portable SSD is the usual recommendation in this slot, and current pricing is on Amazon.

The important part is not the drive. It is that this drive must not stay mounted. Connect it, run the backup, disconnect it. An always-attached drive is inside the blast radius.

Copy two: a different medium

This is where a NAS earns its cost. A network attached storage box gives you spinning disks in a redundant array, snapshots that a client machine cannot overwrite, and a separate operating system that ransomware on your laptop has to break into rather than simply write to. A two-bay unit like the Synology DS224+ covers a household or a small team comfortably.

If a NAS is more than you need, a second external drive on a different technology and a different rotation schedule still satisfies the rule. It is worse, but it is real.

Copy three: offsite and encrypted

Cloud storage with client-side encryption, so the provider holds ciphertext and you hold the key. Set it to retain versions for at least 30 days. Capacity is the thing everyone shops on and the thing that matters least here.

Why versioning beats capacity

Ransomware does not delete your files, it rewrites them. If your backup faithfully syncs whatever the source currently contains, it will faithfully sync the encrypted version over your good one, usually before you notice anything is wrong.

Versioning is what saves you. You do not need the current state of your files, you need the state from before the thing happened. Thirty days of retention is the difference between a bad afternoon and a total loss, and it is the single setting most people never check.

This is the same failure pattern behind the surge in ransomware against large companies this year. The organisations that recovered quickly were not the ones with the most backup capacity. They were the ones with immutable snapshots.

Test the restore, or you do not have a backup

Twice a year, pick a folder at random and restore it somewhere else. Open the files. Check they are what you think they are.

This sounds excessive until you meet the failure modes: a sync job that quietly stopped fourteen months ago, an encryption key nobody wrote down, an archive format the new machine cannot read. None of those announce themselves. All of them are discovered at the worst possible moment.

The bit people forget

Backups protect data. They do not protect accounts. If someone talks their way into your identity provider, as in the vishing calls that got into Abbott, a perfect 3-2-1 setup does nothing, because the attacker is authorised.

Backups sit alongside patching and access control rather than replacing either. Keeping current with things like August's 421-CVE Patch Tuesday reduces how often you need the backup. The backup is what stands up when all of that fails anyway.

Some links in this article are affiliate links. We may earn a small commission at no extra cost to you.