Make backups by keeping at least two additional copies of important data, storing them on different types of storage, and placing at least one copy away from the device or location you are protecting. Then protect those copies from unauthorized access and regularly test that you can restore them. A simple starting setup is an external drive for local recovery plus a vetted cloud or other remote backup for an offsite copy.
How to make a backup plan
Work through these steps for personal files or adapt them to a business’s systems and data. The right schedule and storage choices depend on how often data changes and how quickly you would need it back.
As an Amazon Associate I earn from qualifying purchases.
- Decide what must be recoverable. List important documents, photos, work files, and application data that would be difficult to recreate. For an organization, include the systems and infrastructure required to resume operations.
- Choose destinations that cover those items. An external drive can hold a local copy; cloud or other remote storage can provide an offsite copy. Check exactly what data the service or device saves and how restoration works. Device synchronization alone should not be assumed to provide a complete backup. CISA describes external storage and vetted cloud storage as options in its Data Backup Options guidance.
- Keep multiple copies in different places and storage types. Use the 3-2-1 rule as a baseline: three copies total (the primary data and two backups), on two different media types, with one copy offsite. CISA recommends this approach to improve the chances of recovering lost or corrupted data.
- Set a repeat schedule. Base frequency on how often the data changes and how much recent work you can afford to lose. There is no single schedule that fits everyone. Organizations should establish recovery-point and recovery-time requirements before choosing backup frequency and retention.
- Protect the copies and the access needed to restore them. Encrypt sensitive backups, secure the accounts used to reach them, and retain encryption recovery keys and passwords somewhere safe and retrievable. Keep at least one copy offline or otherwise isolated from routine access; immutable storage may also help where available.
- Test a restore. Restore a representative file or folder to a safe location and verify that it opens and contains usable data. Record the result and correct any failures in the backup setup or recovery procedure.
- Review the plan when things change. Revisit it when you add devices, change important data, or alter operational needs. For operational technology environments, NIST recommends integrating backup management with change management and reviewing it during recovery exercises.
What the 3-2-1 rule means
The rule describes redundancy and separation, not a particular product: keep three copies in all, use two storage types, and keep one copy offsite. Your working data counts as one copy; the other two are backups. A local drive and a remote backup can fill different roles, and the copies do not have to use identical technology.
Recommended Free Tools
The rule is a useful baseline, not a guarantee that recovery will work. A copy that remains connected to an infected device or is reachable through a compromised account may also be vulnerable. Restore tests, access protection, and a copy isolated from everyday systems are important parts of a workable plan.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Choosing backup storage
Compare options by where the copy is kept, how exposed it is to malware or account compromise, how quickly it can be restored, what data and versions it retains, how encryption keys are recovered, and the ongoing cost and effort of using it. No particular drive model or cloud provider is established as best for everyone.
External drive
An external drive can provide a local copy and may be convenient for restoring large amounts of data without relying on an internet connection. CISA advises storing it safely and disconnecting it when it is not actively being used for backup; leaving it connected can expose it to ransomware that reaches the computer.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Cloud or other remote backup
A remote copy can provide the offsite part of a plan and access from another location. Vet the service, understand what it backs up, how account access is secured, and what is required to restore data. Do not treat ordinary synchronization as a backup unless it preserves recoverable copies and versions that meet your needs.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Offline or immutable storage
An offline copy is disconnected from normal system access. Immutable storage, where supported, prevents stored backup data from being changed or deleted during a protected period; the details depend on the system or service. CISA recommends offline, encrypted backups, while Microsoft describes offline, offsite, or immutable copies as ways to resist deliberate deletion or encryption. These measures reduce exposure, but they do not replace restore testing.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Why backup security and recovery tests matter
Some ransomware variants try to find accessible backups and delete or encrypt them. CISA recommends keeping critical backups offline and encrypted, then regularly checking their availability and integrity. Microsoft likewise recommends protecting backup copies against deliberate erasure. A backup is only useful if you can access it safely and the restored files are intact.
Encryption also creates a recovery dependency: if you lose the key or password, you may be unable to read the backup. Keep recovery information in a secure place that remains accessible if the original device or account is unavailable.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
For organizations with strict recovery needs
Testing one file is a useful basic check, but it may not demonstrate that a business application can be restored in the time operations require. NIST discusses end-to-end test restores for applications with strict restoration-speed requirements. Define the acceptable recovery time and the point in time to which data must be restored, then exercise a recovery scenario at the scale required by the service.
Quick Recap
Keep the routine simple enough to maintain
- Automate recurring backups where practical, and check that they complete.
- Disconnect a removable drive after a backup finishes, and store it safely.
- Keep remote accounts and encryption recovery information accessible to the right people without leaving them exposed to the same risks as the data.
- Periodically restore representative files; for business-critical systems, test the broader recovery process as well.
- Update the plan when data, devices, or recovery requirements change.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
