Local Backups: Stop Trusting and Start Testing Your 3-2-1 Setup

Who This Is For

Imagine you're working late on a project, and suddenly your computer freezes. You reboot, and the screen of death appears. You think, "No problem, I have backups." But when you plug in your external drive, nothing happens. The drive is dead. Or maybe you find your backup software has been silently failing for months. This is the nightmare that happens when you trust backups without testing them. This article is for you—the solo professional, the small business owner, the home user who knows they should back up but hasn't thought it through. You need a local backup strategy that actually works when disaster strikes.

Here's the blunt truth: local backup is the foundation of any data protection plan. It's what you control, what you can physically touch. But it's only as good as your last restore test. The best backup in the world is worthless if you can't restore from it. So let's stop assuming and start doing.

Step 1: Know Your RPO and RTO

Before you back up a single file, you need to answer two questions: How much data can you afford to lose? And how long can you afford to be down? These are your Recovery Point Objective (RPO) and Recovery Time Objective (RTO), respectively. NIST defines RPO as the maximum acceptable data loss measured in time—the latest point to which data can be restored. RTO is the maximum acceptable downtime before systems and functions must be restored. You might think you can't afford any loss, but that's unrealistic. Even with continuous backup, there's a lag. So pick numbers: for your critical files, maybe an RPO of 15 minutes and an RTO of 4 hours. For less critical stuff, an RPO of 24 hours and an RTO of 24 hours is fine. Write them down. They'll drive everything else.

Step 2: Follow the 3-2-1 Rule

Now that you know your goals, it's time to structure your backups. The classic rule is the 3-2-1 rule, coined by photographer Peter Krogh: keep 3 copies of your data, on 2 different storage media, with 1 copy off-site. This isn't just for photographers; it's the gold standard for everyone. CISA recommends this rule as a key defense against ransomware. But there's an updated version worth adopting: the 3-2-1-1-0 rule, which adds 1 immutable or air-gapped copy and 0 unverified backups. That means one of your copies should be off-limits to ransomware and other attacks—either on tape that's physically disconnected, or on a cloud service with immutability. And you should verify your backups regularly, so zero are left unverified.

For local backup, you'll typically have your working data on your computer (copy 1), an external drive connected via USB (copy 2), and then a cloud service or a drive at a friend's house (copy 3). The two different media might be your internal SSD and the external HDD. That's the 3-2-1. Add a tape drive or an immutable cloud bucket for the extra '1' if you can.

Step 3: Choose Your Backup Types

You don't need to back up everything every day in the same way. Mix it up. A full backup copies everything—it's your baseline. Incremental backups only copy what's changed since the last backup of any type, which saves time and space but means you need the last full plus every incremental since then to restore. Differential backups copy everything changed since the last full, so you only need the last full and the most recent differential. For local, a common strategy is a full backup on weekends, with incrementals or differentials on weekdays. NIST SP 800-209 lists these types and also mentions continuous backup, like file versioning, which can be great for documents. But don't overcomplicate it. Start with a full backup, then schedule incrementals.

Step 4: Don't Confuse Snapshots with Backups

Here's a common trap: you use a tool that takes snapshots, and you think you're backed up. But a snapshot is not a backup. It's a point-in-time copy that often uses pointers, not a full physical copy. It's fast and space-efficient, but if your primary storage fails, your snapshots are often useless because they depend on the same underlying storage. NIST SP 800-209 points out that if the source data is unavailable, snapshots often won't be usable either. For example, VMware snapshots are just change logs of the original virtual disk—if the base disks are deleted, the snapshot files alone aren't enough to restore a VM. So use snapshots for quick rollbacks, but always have a separate, true backup.

Step 5: Test Your Backups Regularly

This is the step most people skip, and it's the most important. An untested backup is an assumption, and assumptions get you in trouble. NIST recommends testing backups at least monthly for critical data, and doing an end-to-end test restore to a sandbox environment if you have strict restoration speed requirements. CISA also stresses testing backups regularly as a defense against ransomware. So schedule a monthly restore test. Pick a random file, try to restore it. Then pick a whole folder. Then, maybe once a quarter, restore an entire system to a virtual machine to ensure it boots. It's tedious, but it's the only way to know your backups work.

What can go wrong? Plenty. You might find that your backup software has been silently failing for months. Or that your external drive is corrupted. Or that your backup is encrypted by ransomware because it was always connected. That's why you need the 3-2-1 rule and why testing is non-negotiable.

Step 6: Keep a Copy Off-Site

Local backup is great, but it's not enough. If your house burns down, or a thief steals your computer and your external drive, you're sunk. That's why the 3-2-1 rule requires one copy off-site. You can use a cloud service like Amazon S3, which is natively integrated with AWS Backup. AWS Backup allows continuous backups for S3, letting you restore to any point in time within the last 35 days, or periodic snapshots that can be retained for up to 99 years. That's a powerful off-site option. Or you could use tape. LTO-9 tape cartridges offer up to 45 TB compressed capacity and provide an inherent air gap—they're physically offline, so ransomware can't touch them. But tape is slower to restore from, so you'll want to balance that with your RTO.

For most people, a cloud backup service is the easiest way to get that off-site copy. Just make sure you enable encryption and ideally immutability, so ransomware can't encrypt your backups too. And remember, your cloud backup should be a separate copy, not just a mirror of your local drive.

Step 7: Automate and Monitor

The best backup is the one you don't have to think about. Automate your backups so they run on a schedule. Use software that gives you alerts when a backup fails. Don't rely on manually plugging in a drive and remembering to run a script. And once a year, review your backup plan and update it if your data or needs have changed. NIST SP 800-209 recommends reviewing the backup plan at least annually.

Also, consider the security of your backups. Encrypt them, especially if they contain sensitive data. NIST SP 800-209 says sensitive data at rest, including on tapes and disks, should be encrypted, and you should protect your encryption keys for as long as you keep the data, storing keys separately from the data. And if you use a cloud backup, ensure the same level of protection applies there.

Quick Tip

Set a recurring calendar reminder to test a restore every month. It takes 10 minutes and could save your business.

Bottom Line

The single best move you can make today is to schedule a full backup and a test restore within the next 48 hours. Follow the 3-2-1 rule, keep your RPO and RTO in mind, and never confuse snapshots with backups. Regular testing is the only way to turn backup faith into backup certainty.

Sources

• CISA - https://www.cisa.gov/stopransomware
• NIST SP 800-209 - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• NIST SP 800-34 Rev. 1 - https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf
• VMware KB - https://knowledge.broadcom.com/external/article/318825/best-practices-for-using-vmware-snapshot.html
• AWS Backup for S3 - https://docs.aws.amazon.com/aws-backup/latest/devguide/s3-backups.html
• LTO Program - https://www.lto.org/newsbytes-september-2022/