The Problem / Starting Situation
You've spent hours working on your tax return, sorting photos from the last family gathering, and finishing an important document for a client. Then suddenly: the screen freezes, a popup appears, and all your files have been encrypted. A ransom demand in Bitcoin pops up on your monitor. That's exactly what happens when ransomware strikes - and not just at large corporations, but increasingly also at private users and small business owners.
Many victims first think about paying the ransom in this situation. The bitter truth is: even those who pay don't necessarily get their data back. In many cases, only one thing helps - a working, up-to-date backup that attackers weren't able to destroy. This is exactly where the 3-2-1 backup strategy comes in.
In this article, we'll show you what the 3-2-1 backup strategy actually means, why now is the right time to set it up, and how you can implement it as a private user or small business owner without deep IT knowledge.
Why This Matters Now
The number of ransomware attacks on private users and small offices has noticeably increased in recent years. Criminals use phishing emails, compromised downloads, and vulnerabilities in commonly used software to gain access to systems undetected. Once there, they don't just encrypt obvious documents, but also cloud-linked sync folders, connected external hard drives, and network shares.
On top of that, modern ransomware families are patient. They often wait for weeks, silently spreading in the background, and then encrypt everything at once. Anyone who regularly makes backups on a connected medium during this phase may not even notice that the malware has already encrypted all the supposedly safe copies.
For this very reason, the 3-2-1 backup strategy is gaining importance again. The principle has been known for decades, but only a few actually implement it. Those who consistently apply it now shift the balance of power back to their own side in an emergency. You won't become someone forced to pay; instead, you can reset your system and get back to work within a few hours.
Step-by-Step Solution
The 3-2-1 backup strategy sounds like a lot of effort at first, but in practice it's surprisingly simple. You don't need a server or an expensive NAS - a second medium and a little discipline are enough.
Step 1: Three Copies of Your Data
The "3" in 3-2-1 backup stands for three copies. In addition to your original data on the PC, you should create two additional backup copies. It sounds redundant, but that's the point: even if one backup medium fails, you'll still have at least one copy left.
In concrete terms: your original files on the PC or laptop are copy number one. Then comes a full backup on an external hard drive, and a cloud backup is recommended as the third copy. In everyday life, it's enough if the second copy is only updated every few days - the important thing is that it exists.
Step 2: Two Different Types of Media
The middle digit "2" stands for two different types of media. The goal is to prevent a typical defect from hitting both backups at the same time. If both copies are on hard drives from the same manufacturer, made in the same production batch, they can age or fail at similar rates.
The combination of a local external hard drive and a cloud backup has proven effective. The external hard drive typically uses HDDs or SSDs, while the cloud uses entirely different storage systems. With just two media types, you're well covered. Alternatively, you can combine a NAS drive with a USB stick if you don't want to use the cloud.
Step 3: Keep One Copy Off-Site
The last digit "1" is especially important against ransomware: one copy must be stored somewhere that is permanently separated from the running system. An external hard drive that is always plugged into the PC's USB port is no protection in an emergency, because the ransomware can encrypt it as well.
So keep your external hard drive somewhere else. That could be a cabinet in another room, a safe deposit box, or a friend's workplace. At least once a week, plug in the drive, back up your current data, and disconnect it again. Alternatively, use a cloud backup that is permanently separated and only responds to access requests.
Step 4: Automate Your Backups
Discipline is good, automation is better. If possible, create a weekly schedule: trigger a cloud sync on Sunday evening, then do the local backup on the external hard drive on Monday. Windows 10 and Windows 11 already ship with useful built-in tools like "Backup and Restore" and File History - you can find more details in the BSI data backup overview.
If you regularly connect an external hard drive, it's also worth looking at free tools like Duplicati or Veeam Agent for Windows. Both are free in their basic versions, can run on a schedule, and support optional versioning: this way you can access a file from two weeks ago, even if ransomware has already compromised your current version.
Step 5: Test the Restore
A backup you've never restored is not a backup - it's just a file with the word "backup" in its name. At least once a quarter, you should check whether you can actually perform a full restore with your tool. To do this, load a small selection of files from the backup into a temporary folder and open them. If that works smoothly, you're on the safe side.
What Can Go Wrong
The 3-2-1 backup strategy is robust, but not infallible. In practice, we keep seeing the same pitfalls.
The Backup Medium Was Permanently Connected
A classic scenario: the external hard drive sits permanently under the desk, always powered on, and only separated by USB. For modern ransomware, that's no obstacle. As soon as the malware has sufficient privileges, it encrypts the connected hard drive as well. Even a disconnected drive that is stored in the same room is at risk if the attacker pretends to be the owner in person. Store the drive somewhere genuinely different.
Cloud Backup Gets Silently Overwritten
Cloud services like OneDrive, Google Drive, or Dropbox sync changes in both directions by default. If a file on your PC is encrypted, the cloud replaces its copy with the encrypted version. That means you've lost your cloud backup on the day of the attack. You either need a cloud service with true versioning like Backblaze, IDrive, or one of the many online backup solutions, or you need to actively enable versioning. More background on typical pitfalls can be found in the guide 3-2-1 Backup: Implementing it ransomware-resilient.
The Backup Medium Is Outdated
Hard drives age. USB sticks become less reliable after a few years of write use. Anyone who doesn't update their backup for years risks the drive no longer being readable when it's needed. An annual full refresh is therefore worthwhile: keep the old drive, buy a new one, copy the data over, and shelve the old drive as an extra layer.
Backups Are Never Tested
Many users rely on the assumption that their backup will work. Only in an emergency do they discover that their backup software has silently stopped running backups for months due to licensing issues, a full drive, or a conflict with other programs. A good backup routine therefore includes the test restore we described above. You should also review your backup logs regularly, since many programs leave hints about failed backups there.
Ransomware Stays Undetected for Months
As mentioned at the beginning, modern ransomware families often wait for weeks before striking. Backups made daily during this time and connected to the PC are just as compromised as the originals. The solution is consistent: your most important backup must not be accessible during this phase. That's exactly what the "1" in 3-2-1 backup means. It's also recommended to run at least one backup in a write mode where it cannot be automatically overwritten, such as via external read-only mode or through an immutable cloud solution. More background on implementation can be found in the article Backup & Ransomware Protection: 5 Critical Measures for 2026.
Connection to the Book
Chapter 11 "Protection Against Ransomware and Data Loss" of our book publication "Securing Windows" picks up the 3-2-1 backup principle and places it in a broader context: which behavioral rules keep ransomware off your PC in the first place, which Windows built-in tools and third-party software enable sensible data backup, and what an emergency plan looks like for a worst-case scenario. You'll also find a concrete guide to the Windows File History feature and instructions on how to recover after a successful attack.
You can find more information and a free sample chapter at windows-absichern.de/en/excerpt.html. If you'd like to purchase the complete book as a digital edition, head over here: windows-absichern.de/en/ebook.html.
FAQ
What exactly does the 3-2-1 backup strategy mean?
You create three copies of your data, store them on two different types of media, and keep one copy in an external, separate location. This way, you're protected even if a backup medium or your PC fails completely or is compromised.
Is a single external hard drive enough as a backup?
A single external hard drive is better than nothing, but it does not meet the 3-2-1 backup strategy. As soon as ransomware has write access on your PC, it can also encrypt the connected drive. You need at least one medium that is not permanently attached to the PC.
How often should I create a backup?
For most private users, a weekly backup makes sense, or a daily one if your data changes a lot. What matters most is that you actually do it regularly and test the restore every now and then.
What is the difference between 3-2-1 and 3-2-1-1-0?
The BSI extends the 3-2-1 principle with two additional aspects: a fourth, immutable backup (1) and the verification that no backups are faulty (0 errors). For private users, 3-2-1 alone is often already a solid step forward.
Cloud backup or local backup - which is better?
Both have their merits. Local backups on an external hard drive are fast and cost little per gigabyte. Cloud backups are location-independent and survive a house fire or water damage. The 3-2-1 backup strategy even recommends combining both options.
📖 Want More Protection?
"Protection Against Ransomware and Data Loss" is just one of 14 chapters in the practical guide <strong>"Securing Windows"</strong> — step by step, no prior knowledge required, for private users and small business owners.