iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A practical 3-2-1 backup strategy keeps three copies of important data in total, uses two genuinely different storage media, and places at least one copy somewhere other than the primary location. The original working copy counts as one of the three. Add an offline or otherwise isolated copy when possible, then set backup frequency, retention and restore procedures around how much data you can lose and how quickly you must recover it.
What the 3-2-1 rule actually requires
The rule is a design pattern, not a product specification. You begin with the live data on a computer, server or network-attached storage system. That primary copy is copy one. Two additional, recoverable copies make up the other two. Those copies should use two different types of storage media, and one copy must be held offsite so a fire, flood, theft or other local incident does not destroy everything together.
For stronger protection, many organisations use a 3-2-1-1 arrangement: three total copies, two media types, one offsite copy and one offline or isolated copy. The extra “1” addresses a threat that ordinary replication does not solve. Ransomware or a compromised administrator account can delete, encrypt or corrupt a backup that remains continuously reachable from the production network.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11A synchronised folder is therefore not automatically a backup. Synchronisation can faithfully reproduce an accidental deletion, malicious encryption or unwanted change. A backup needs retained versions, a way to select an earlier state and a recovery path that remains separate enough from the primary system to survive the same incident.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Start with recovery requirements, not a particular drive
Inventory the data and services
List the files, databases, applications, configurations and identity systems that would matter after a device failure or site incident. Include data on laptops, desktops, servers, NAS appliances, removable media and hosted services. Note who owns each set, where it is stored, how large it is and what software is needed to make a restored copy useful.
Separate irreplaceable personal files, business records, application data, operating-system images and temporary data. A complete system recovery may require configuration files, database transaction data, application installers, encryption keys and access information in addition to user documents.
Set the recovery point objective (RPO)
The RPO is the maximum amount of recent work that may be lost. If losing a day of changes is acceptable, a daily backup may satisfy the objective. If an hour of work is the limit, the backup process must run more often or capture changes continuously while still preserving recoverable versions. The RPO should be set separately for each data tier rather than imposed as one schedule on everything.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Set the recovery time objective (RTO)
The RTO is how quickly data and services must become usable after an incident. A small file restored from a local disk has a different path from a multi-terabyte application restored over a limited internet connection. RTO decisions affect whether you need a local copy for fast access, how much bandwidth is required, the order in which systems are recovered and whether a full application restore must be rehearsed.
Define retention and dependencies
Retention describes how many versions and how much history to keep. Base it on business, household or legal requirements, not on the number of files that happen to fit on a disk. Record dependencies such as databases, application servers, identity services, configuration, encryption keys and licensing. A file can be intact yet unusable if the software or credentials required to open it are missing.
Reference layouts for different situations
The following arrangements illustrate how the rule can be implemented without tying it to a particular vendor. In every row, copy one is the live primary data.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
| Situation | Copy 1: primary | Copy 2: local backup | Copy 3: offsite backup | Additional isolation |
|---|---|---|---|---|
| Home user or small office | Computer or NAS | Scheduled backup to a separate external hard drive or other local destination | Separately stored backup service or removable media at another location | Disconnect the local drive between runs when practical, or restrict its access |
| Small organisation or higher-value data | Production systems and applications | Managed local backup repository with retained versions | Copy held in a different physical location or an independently administered hosted service | Offline or immutable retention, separate backup administration and documented recovery catalogue |
An external drive plus a cloud-synchronisation folder should not be declared compliant by default. Confirm that the remote copy retains earlier versions, permits deletion recovery, has adequate retention and can be restored if the original account or device is lost. “Cloud” identifies a service and location; it does not by itself prove a different physical medium or an independent security boundary.
What counts as two different storage media?
Different media are valuable because they fail in different ways. CISA describes media diversity as protection against different hazards, while New Zealand’s National Cyber Security Centre gives magnetic tape and an external hard drive as examples. A practical decision considers more than the material itself: access path, account permissions, physical location, durability, restore speed, capacity and the likelihood that compatible hardware will still exist during the retention period.
| Option | Where it can fit | Questions and limitations to check |
|---|---|---|
| External hard drive | Convenient local backup destination for a computer or NAS | Can ransomware reach it through the logged-in account? Can it be disconnected or access-restricted between runs? Is the drive stored separately from the primary device? |
| Local disk repository | Frequent backups for servers or multiple workstations | Does a failure of the same enclosure, controller or room affect both production and backup? Are versions protected from ordinary deletion? |
| Flash or solid-state storage | Portable or fast-restore copy where compatible equipment is available | Can the device be isolated and monitored, and will it remain readable for the whole retention period? |
| Magnetic tape | Removable, offline or long-retention copy | Are the correct drives, software and trained operators available? Can the transfer finish before the next run, and are cartridges stored securely? |
| Optical media | Removable archive for selected data | Will the media remain readable and will compatible readers and software be retained? Does its capacity meet the backup window? |
| Hosted cloud backup | Offsite copy with provider-managed storage and transfer | How are versions retained, what is the restore method and speed, where is data located, who controls deletion, and how are encryption keys recovered? |
| Removable media at another location | Offsite and potentially offline copy | Who controls physical access, how is rotation tracked, and how often is readability checked? |
Restore speed is a separate design axis from media diversity. NCSC notes that restoring from solid-state drives will be much quicker than restoring from tape. A tape copy may still be the better choice for offline retention if its slower recovery fits the RTO. Large transfers also need capacity and scheduling checks; NCSC warns that transfers can overlap when a backup cannot finish before the next run.
Build the strategy step by step
-
Step 1: classify data into recovery tiers
Group data by importance, acceptable loss and required restoration time. Give each tier an owner. Keep the tier definition with the backup policy so a new application or dataset receives a deliberate frequency and retention setting instead of silently inheriting an unsuitable default.
-
Step 2: choose a local destination for routine recovery
Use a separate destination for copy two, such as an external hard drive or local repository. Automate the job, include version retention and configure alerts for failures. If the destination is removable, disconnect it after a successful run whenever practical. If it must remain connected, limit which accounts and systems can modify it.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Step 3: create the offsite copy
Send a recoverable copy to a different building or a separately controlled hosted service. Check the physical region, account ownership, deletion process, retention history and restoration workflow. Make sure the offsite process can continue if the primary device is destroyed and that someone can retrieve credentials and encryption keys without relying on that same device.
Rank #3
Seagate Portable 1TB External Hard Drive HDD – USB 3.0 for PC, Mac, PlayStation, & Xbox, 1-Year Rescue Service (STGX1000400) , Black- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
-
Step 4: add offline or immutable protection
Keep at least one version unavailable to ordinary network access when feasible. This may be a disconnected removable medium, a protected retention tier or another isolation mechanism. Offline media still needs secure physical storage, an inventory and periodic readability checks; isolation does not excuse maintenance.
-
Step 5: set frequency and retention from the RPO
Schedule each tier often enough to meet its permitted loss. Preserve enough versions to cover the required history, including a clean point before a malicious change is discovered. Document whether retention is measured by versions, time or both, and what happens when the retention window expires.
-
Step 6: encrypt data and protect the keys
Use encryption for sensitive backup data at rest and in transit. Store encryption keys under controlled access and retain a recovery path for them. Never leave the only usable key beside the only copy of the encrypted data. Record key ownership, rotation arrangements and the procedure for using a replacement key during recovery.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Step 7: separate backup administration
Restrict who can read backup data, change retention, delete versions or alter the backup policy. Keep backup administration separate from ordinary production access so a compromised production credential cannot erase every copy. Review access when staff, devices, applications or service accounts change.
-
Step 8: monitor completion and maintain a catalogue
Track successful and failed jobs, copy location, version, retention status, encryption status and the steps needed to restore. An alert that nobody reviews is not monitoring. The catalogue should identify the latest usable copy and the dependencies required to open or run the restored data.
-
Step 9: test a restore before an incident
Restore representative files and complete systems into a safe location. Check integrity, permissions, application behaviour and elapsed time. For workloads with strict RTOs, perform an end-to-end sandbox restore that includes dependencies and recovery ordering rather than testing files in isolation.
Rank #4
Sale
WD 2TB Elements Portable External Hard Drive for Windows, USB 3.2 Gen 1/USB 3.0 for PC & Mac, Plug and Play Ready - WDBU6Y0020BBK-WESN- High capacity in a small enclosure – The small, lightweight design offers up to 6TB* capacity, making WD Elements portable hard drives the ideal companion for consumers on the go.
- Plug-and-play expandability
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
-
Step 10: refresh the design as technology changes
Replace or migrate media before it becomes unreliable or unsupported. Preserve compatible readers, software and key material for as long as retained copies must remain usable. Repeat the assessment after a major application, storage, network or account change.
PerformanceWindows Errors? Fix Them Before They SpreadDriversOutdated Drivers Are Slowing You DownPerformancePC Slower Than It Used to Be?Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Secure each copy against correlated failure
Separate physical and logical failure domains
Two devices in the same room can be destroyed by the same fire, flood, theft or power event. Two accounts in the same administrative domain can be compromised together. Evaluate whether each copy survives the same device, building, region, network path and credentials as the primary. Media diversity without separation of access and location can create a false sense of safety.
Use offline or isolated storage for ransomware resilience
HHS OCR’s October 2022 newsletter states: “Because some malware, including some ransomware variants, are known to delete or otherwise disrupt online backups, regulated entities should consider maintaining at least some of their backups offline and unavailable from their networks.” The statement is guidance for regulated entities, not a universal legal requirement. Its underlying risk applies more broadly: an online backup that is writable from a compromised production account may be attacked during the same incident.
Protect locations and physical media
Store removable media where unauthorised people cannot alter or remove it. Keep an inventory of who holds each item, which version it contains and when it was last checked. Offsite does not mean unattended; the location must support secure access, environmental protection and eventual retrieval.
Preserve encryption and recovery information
Document where keys, credentials, configuration and restore instructions are held. Ensure that the loss of one device or one employee account does not make every encrypted copy unusable. Access to this information should be restricted, but the recovery team must be able to obtain it during a declared incident.
Free tools Windows power users keep installed
One-click scans. No signup required.
Test restores, not merely backup jobs
A completed backup job proves that a process ran. It does not prove that the resulting data is intact, that the required key is available or that a complete service can be rebuilt within its RTO.
Best Value
- Plug-and-play expandability
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
Use tests that match plausible incidents
- Restore a deleted file and verify its contents, permissions and version.
- Roll back an application after an upgrade causes a failure.
- Recover a database and check related application components.
- Restore an operating system and its configuration.
- Recover identity and access systems before applications that depend on them.
- Rebuild a complete service in a sandbox when the workload has a strict restoration-speed requirement.
Set a testing cadence
NIST Special Publication 800-209 (2020) recommends: “Periodically test backups (at least monthly for critical data) to verify their integrity and their ability to be restored.” Treat that as a testing recommendation for critical data, not as evidence that every dataset needs the same interval. Test more often after major changes and whenever a failure, migration or security incident exposes uncertainty.
Record the result
For each exercise, record the date, copy and version used, systems included, elapsed restoration time, integrity checks, blockers and corrective actions. Compare the elapsed time with the RTO and the recovered point with the RPO. A small-file test cannot establish that a full system will meet either objective.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How the plan responds to common incidents
Primary computer or server failure
Use the local copy for the fastest practical restoration, then verify that the restored system has the required applications, configuration and keys. Keep the offsite copy available as a fallback if the local destination or its enclosure also failed.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsAccidental deletion or unwanted change
Select a retained version from before the event. A mirror or synchronised folder may contain only the deletion, so confirm that version history and deletion recovery are enabled before relying on it.
Ransomware or compromised credentials
Stop using affected credentials and preserve the isolated copy. Recover a known-good version, scan and validate the restored environment, then review how the attacker reached writable backups. Do not reconnect a removable copy until the production environment and access paths are controlled.
Fire, flood or theft at the primary site
Use the offsite copy and follow the documented order for identity, configuration, databases and applications. Confirm that the offsite location, credentials, keys and restoration bandwidth are available without the original building or device.
Common design mistakes and their fixes
- Counting the original incorrectly: The original is copy one; two additional recoverable copies are still required.
- Treating synchronisation as backup: Require retained versions, deletion recovery and an independently protected destination.
- Using two devices with one failure domain: Separate location, account permissions, administration or network access as well as media.
- Leaving every copy online: Add a disconnected, isolated or immutable version and test that it remains readable.
- Choosing frequency by habit: Set schedules from each tier’s RPO and verify that transfer windows do not overlap.
- Ignoring restoration speed: Match local capacity, bandwidth and media to the RTO; slower media may be unsuitable for urgent services.
- Forgetting keys and dependencies: Catalogue encryption keys, software, configuration and identity services alongside data.
- Never testing a full recovery: Exercise realistic scenarios, including application-consistent and sandbox restores where required.
- Keeping obsolete media indefinitely: Migrate before hardware or software support disappears and retain compatible readers for the full retention period.
- Failing to review alerts: Assign an owner for backup failures, investigate missed runs and document corrective action.
Questions to ask an offsite backup provider
Evaluate a hosted service as one component of the architecture, not as proof that the architecture is complete. Ask:
Recommended Free Tools
- How many historical versions are retained, and can an administrator recover data after deletion?
- What is the restore mechanism, expected throughput and process for a large recovery?
- Is data encrypted in transit and at rest, and who controls the keys?
- How can keys and credentials be recovered if the primary device or account is unavailable?
- Which users, service accounts and provider staff can delete or alter copies?
- Can a retention copy be made immutable or otherwise isolated from ordinary network access?
- Where are copies physically located, and which regional outage scenarios are covered?
- How are failed jobs reported, and can the service export a catalogue of versions and restore instructions?
- What are the costs of storage, transfer, retrieval and any emergency restoration method?
A maintenance checklist
- Confirm that each important dataset has a primary copy and two additional recoverable copies.
- Verify that two media types and an offsite location still provide independent failure domains.
- Check that at least one version is offline, isolated or immutable where the threat model warrants it.
- Review backup success, failures, retention and available capacity.
- Verify encryption, key recovery, access permissions and backup-administration separation.
- Check removable media readability and confirm that compatible hardware and software remain available.
- Perform restore tests that reflect likely incidents and compare results with RPO and RTO.
- Update the recovery catalogue after changes to applications, identity, storage, locations or responsible staff.
The strongest 3-2-1 strategy is the one that can be operated and recovered under pressure. Choose media for independent failure behaviour, keep at least one copy away from the primary site, isolate a version from routine network access, and prove the entire recovery path through scheduled tests.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
