Backup of Backup: The 3-2-1 Rule Explained Simply (Guide)

What Is a Backup of Backup?

The 3-2-1 rule in one table

Number	Rule	Home example	What it protects against
3	Three copies of the data	Laptop + external drive + cloud backup	Any single copy failing
2	Two types of media	Internal SSD and an external drive, or a NAS	Faults that hit one kind of device
1	One copy off site	A cloud backup service	Fire, flood, theft and ransomware at home

In ten years of backup work, one case repeats more than any other. Someone did back up, but to one drive that sat next to the computer. When that drive failed or was stolen with the laptop, nothing was left. A backup of backup would have saved them.

What Does Each Number in the 3-2-1 Rule Mean?

Each number closes a different gap. Backblaze, a backup provider, defines the rule as “at least three copies of data, stored on two different types of media, with one copy kept off-site” (Backblaze).

3: Three copies of your data

Your original files count as the first copy. You then need two backup copies. With three copies, two must fail at the same time before you lose anything, which is far less likely than one failure.

2: Two different types of media

Devices of the same type often fail for the same reasons. A batch of faulty drives or a power surge can hit them together. Mixing media, such as an SSD, an external hard drive and cloud storage, spreads that risk.

1: One copy off site

The off-site copy survives what happens to your building. A fire, a burst pipe or a burglary can take your computer and the drive beside it. For most people, a cloud backup service is the easiest off-site copy.

Why Is One Backup Copy Not Enough?

One backup copy fails whenever the same event hits both the original and the backup. These are the four situations where a single backup most often lets people down.

• The backup drive fails first. Drives wear out silently, and you may only learn it on the day you need a restore.
• Ransomware reaches the backup. A drive that stays plugged in can be encrypted along with your computer.
• One event takes both. A theft or a fire takes the laptop and the drive on the same desk.
• The backup was never complete. A full disk or a skipped folder leaves gaps you only find later.

Ransomware is the strongest reason for a second, separate copy. CISA warns that “many ransomware variants attempt to find and subsequently delete” accessible backups. It therefore advises keeping backups offline and encrypted (CISA #StopRansomware Guide).

What Does a 3-2-1 Backup Copy Setup Look Like at Home?

A backup of backup at home usually needs one external drive and one cloud backup service. The table below shows three common setups, from simplest to most complete.

Three common 3-2-1 setups

Setup	Copy 1	Copy 2 (local)	Copy 3 (off site)	Best for
Basic	Laptop	External drive with Time Machine or File History	Cloud backup service	Most homes and students
Photo and media	Computer	NAS with mirrored disks	NAS sync or backup to cloud	Photographers, video editors, families
Small office	Work PCs and shared files	NAS or local backup server	Cloud backup with a different company	Teams of 2 to 20 people

If you keep your working files in Google Drive or OneDrive, remember that storage is not a backup copy. Our guide on cloud storage vs backup explains how to count those files correctly.

For the NAS setups, see our guides to NAS backup and to sending a NAS backup to the cloud. For Windows computers, start with our Windows backup guide.

How to Build a Backup of Backup, Step by Step

You can build a backup of backup in one afternoon of hands-on work. The cloud upload then finishes on its own over the next days.

1. Measure your data. Add up the size of the folders you cannot lose, then buy an external drive at least twice that size.
2. Set up the local backup. Use Time Machine on a Mac or File History on Windows, and choose an hourly or daily schedule.
3. Encrypt the external drive. Turn on the backup tool’s encryption, so a lost drive does not expose your files.
4. Add a cloud backup. Install a backup service and select the same folders.
5. Use a different company for copy 3. Keep your off-site backup outside your main storage account.
6. Unplug the local drive between backups. Alternatively, use a backup tool with protected snapshots.
7. Write down your keys and passwords. Store them in a password manager and on paper in a safe place.
8. Test a restore from each copy. Restore a few files from the drive and from the cloud, then open them. Our guide on how to check a backup explains each step.

What Is the 3-2-1-1-0 Rule?

The 3-2-1-1-0 rule is a stricter version that some backup vendors use. It adds one copy that is offline or immutable, which means it cannot be changed or deleted for a set time. The “0” stands for zero errors after you verify the backup.

Immutable copies directly answer the ransomware problem. CISA notes that “some cloud vendors offer immutable storage solutions that can protect stored data” and recommends delete protection or object lock where available. However, it also adds that immutable storage does not meet certain compliance rules.

For a home user, a practical version is simple. Keep one external drive unplugged, and choose a cloud service with long version history. Many small offices add object lock on their cloud backup bucket.

Is a Second Copy in the Same Account a Real Backup?

No, it is not fully independent. If both copies sit in one cloud account, one lost password, hacked login or closed account removes both. CISA even suggests considering “a multi-cloud solution to avoid vendor lock-in for cloud-to-cloud backups.”

The same logic applies at home. Two folders on the same disk count as one copy, because one disk failure destroys both. Likewise, RAID mirrors protect against a dead disk but copy deletions and ransomware instantly. Therefore, RAID alone is not a backup.

Privacy: Protecting Every Copy

More copies mean more places your data can leak, so protect each one. Encrypt the external drive, use a private key on the cloud backup if you can, and turn on two-factor login everywhere.

Also think about old drives. Wipe or destroy a retired backup drive before you sell or recycle it. A forgotten drive in a drawer is a common source of leaked personal files.

Common Myths About Backup Copies

“Two backups on the same drive are enough”

One drive is one point of failure, whatever you store on it. Spread copies across separate devices and places.

“The cloud already keeps several copies”

Providers do replicate data across disks and data centers. That protects their hardware, not your mistakes. If you delete a file or lose the account, every replica follows.

“3-2-1 is too expensive for home use”

A basic setup costs one external drive plus a cloud backup plan. Compare that with the cost of losing years of photos or work files, which no money can buy back.

Frequently Asked Questions

Should I back up my backup drive to the cloud?

You can, but it is usually better to back up the original computer to the cloud directly. Backing up the backup drive copies its errors as well. If the drive holds files that exist nowhere else, such as an archive, then yes, include it in your cloud backup.

How often should I update each backup copy?

Match the schedule to how much work you can afford to lose. Most people run the cloud backup continuously or daily and the local backup hourly or daily. For an unplugged drive, connect it at least once a week, and more often during busy periods.

Can two cloud services count as two types of media?

Partly. Two independent cloud providers protect you from one account or one company failing. However, both depend on internet access and on remote restores. For that reason, keeping one local copy on your own hardware still gives faster, offline restores when you need them.

Is a USB flash drive good enough for a backup copy?

Only for small amounts of data, and only as an extra copy. Flash drives are easy to lose and can wear out with frequent writes. For a computer backup, an external hard drive or SSD built for repeated backups is a more reliable choice.

How far away should my off-site copy be?

Far enough that one local event cannot reach both places. A different building is the minimum, and a different town or region is better for floods and storms. Cloud backup services usually meet this automatically, because their data centers are far from your home.