Three copies, two media, one offsite: the 3-2-1 rule for your files

Q: What each medium gives and costs

Cloud storage: protects against worst cases such as natural disasters or local devices failing to malware, and is reachable anywhere with an internet connection. On the other side it depends on that connection, and you give up much of your control over the data, so the paper advises reading the service agreement and choosing a provider that encrypts. External drives and flash storage: unplugged, they keep the backup away from online attackers and power surges. Their weakness is that being portable makes them easy to lose or steal, so password-protect and encrypt them, and disconnect them once the backup is done. For a household, that works out as the original on your computer or phone, one copy on an external drive you unplug after each backup, and a third in a cloud service, which doubles as your offsite copy. Photo: a read head over the platter of an opened hard disk. Photograph by Eri

Automatic sync quietly carries corruption and malware into the backup itself, so it isn't enough alone.

17 October 2026 Tech 2 min read

Phone photos, a scanned lease, work documents: most people keep them in one place, or in two places they assume are separate copies. The rule the US Computer Emergency Readiness Team (US-CERT) recommends to every user, from home to the office, fits in three numbers: 3-2-1.

What the numbers mean

3: three copies of any important file, the original and two backups.
2: on two different types of storage media, because each type has its own hazards.
1: at least one copy stored offsite, outside your home or office.

Why sync on its own falls short

A backup that updates itself automatically is convenient, but the paper warns that it can silently spread corruption or malware from the original into the backup. And a backup kept on the same drive as the original is lost with it if that drive fails or the computer is stolen.

What each medium gives and costs

Cloud storage: protects against worst cases such as natural disasters or local devices failing to malware, and is reachable anywhere with an internet connection. On the other side it depends on that connection, and you give up much of your control over the data, so the paper advises reading the service agreement and choosing a provider that encrypts.
External drives and flash storage: unplugged, they keep the backup away from online attackers and power surges. Their weakness is that being portable makes them easy to lose or steal, so password-protect and encrypt them, and disconnect them once the backup is done.

For a household, that works out as the original on your computer or phone, one copy on an external drive you unplug after each backup, and a third in a cloud service, which doubles as your offsite copy.

Photo: a read head over the platter of an opened hard disk. Photograph by Eric Gaba, CC BY-SA 3.0 via Wikimedia Commons.

Source: “Data Backup Options”, US Computer Emergency Readiness Team (US-CERT), published on cisa.gov, read 16 October 2026.