Backups made simple: the 3-2-1 rule that protects your photos and files

Why backups matter more than almost anything

Most security advice is about stopping bad things happening. Backups are the one measure that helps after they have happened. Whether the cause is ransomware, a stolen laptop, a phone dropped in water, a failed drive, a flood or an accidental delete, the question afterwards is the same: can you get your files back?

For most families the answer decides whether a child’s photos, years of tax records and a decade of work survive. For small businesses it decides whether Monday is a bad day or a lost week. CISA’s ransomware guidance puts offline, encrypted, regularly tested backups first among its recommendations for exactly this reason.

The 3-2-1 rule

The 3-2-1 rule is a simple pattern that has been recommended for years, including by CISA. It means:

• 3 copies of your data: the original and two backups.
• 2 different types of storage. For example, your computer’s drive and an external hard drive, or an external drive and a cloud service. If one type fails or is hit by the same problem, the other survives.
• 1 copy off-site. Away from the place where the original is kept, so a fire, flood or burglary does not take everything.

Many security teams now add two more points, called 3-2-1-1-0: one copy that is offline or immutable (it cannot be changed or deleted, even by you), and zero errors when you check the backups. For businesses and regulated industries that fuller version is worth adopting. For a household, the basic 3-2-1 with one disconnected copy is an excellent start.

Sync is not backup

This is the most common mistake. Services that sync your files, such as a cloud folder on your computer, copy every change. That is convenient, but it also copies deletions, mistakes and encrypted files. If ransomware scrambles your documents, the synced copy can be scrambled too.

A true backup keeps older versions you can go back to, or sits somewhere that your infected device cannot reach. Look for version history, “restore previous version” options, or a separate backup product, and use sync as a convenience rather than as your only safety net.

A simple set-up for a family

You do not need special skills. Here is a realistic plan that gets you to 3-2-1 in an afternoon:

1. Decide what matters. Photos and videos, tax and legal documents, school and work files, and anything you could not recreate. Do not worry about programs, which can be reinstalled.
2. Copy one: the original. Your phone and computer, as they are today.
3. Copy two: an external drive. Buy a drive with plenty of room and back up to it with your computer’s built-in tool (Time Machine on a Mac, File History or Windows Backup on Windows). Phones can export photos to it too.
4. Copy three: off-site. Either a second drive you keep at a relative’s home or work, or an encrypted cloud backup service that keeps version history.
5. Disconnect the drive. After each backup, unplug the external drive. A drive left permanently connected can be encrypted by ransomware along with everything else.
6. Encrypt backups that leave the house. Choose a strong password and store it in your password manager, with a printed copy of the recovery key somewhere safe.
7. Set a reminder. Once a month is better than never. Many tools can run on a schedule, but you still need to plug the drive in.

For small businesses

If you run a business, the same rule applies with a few additions:

• Back up your accounting data, customer records and shared drives, not just individual laptops.
• Keep at least one backup copy that cannot be changed or deleted from your normal accounts.
• Write down how long a restore takes. If it would take three days, you need to know that before you need it.
• Include your email and any cloud systems you rely on. Provider outages and account lockouts happen.
• Keep your recovery instructions and key passwords somewhere that does not depend on your own network.

Our small business basics guide and our ransomware explainer show how backups fit with the other habits.

What about your phone?

Phones hold most families’ photos, messages and contacts, and they are lost or broken more often than computers. Your phone’s maker offers a built-in cloud backup, and you should turn it on, but check what it does. Some settings back up the whole device. Others only sync photos.

• Turn on the phone’s own backup (iCloud Backup on iPhone, or Google backup on Android) and check that it runs on Wi-Fi regularly.
• Make sure photos and videos are backed up, either through the phone’s cloud or by copying them to a computer and external drive.
• Check that your authenticator app has a backup or recovery method. Lose that, and you can lose access to your accounts. See our two-factor guide.
• Store a copy of your important contacts and documents off the phone.

Remember that the cloud is one copy, not three. It is one of your “2 types of storage”, so add a second one.

Common backup mistakes

• Leaving the backup drive plugged in all the time. A connected drive can be encrypted by ransomware or damaged by a power surge along with the computer.
• Backing up only the “Documents” folder. Photos, downloads, desktop files and application data are often elsewhere.
• Never checking. Backups can fail silently for months. Look at the last backup date once a month.
• Losing the encryption password. An encrypted backup you cannot open is no backup at all. Store the key in your password manager and keep a printed copy.
• Keeping every copy in one place. Two drives in the same drawer are one copy as far as a fire or burglar is concerned.
• Trusting old drives. Hard drives wear out. Replace backup drives every few years and do not keep irreplaceable files on a single old disk.

Old photos and long-term keepsakes

Family photos and videos are often the most precious thing you have, and the most poorly protected. Printed photos can be scanned. Old phones and cameras hold forgotten files. Memory cards and old drives fail without warning.

• Gather photos from old phones, cameras and cards in one place and copy them to your main backup.
• Give your files simple, consistent folders (by year, for example) so you can find them in future.
• Keep a second copy of the most important ones with a relative, or in an encrypted cloud account.
• Check on them once a year and move them to new storage when the old kind stops being common.

Test your restore

A backup that has never been restored is an assumption. Drives fail, software settings change, and one important folder is often missed. CISA’s guide says backups should be tested regularly for this reason.

1. Pick a few files, including a recent photo and an important document.
2. Restore them from the backup to a different location.
3. Open them and check they are complete.
4. Once or twice a year, try a larger restore, such as a whole folder, so you know the process.

Put a recurring reminder in your calendar. The five minutes it takes is the cheapest insurance in this whole site.

Sources

• CISA: #StopRansomware GuideAccessed October 12, 2026
• NinjaOne: The 3-2-1 backup rule explainedAccessed October 12, 2026

Published October 12, 2026. We check every claim against the sources above and say clearly when something is advice rather than fact. This guide is general information, not legal or financial advice. Dollar amounts are in US dollars, as reported.