Losing files rarely comes with a warning. A drive dies overnight, a laptop gets stolen from a car, or ransomware locks every shared folder on your NAS before you notice. The 3-2-1 backup rule gives PC and NAS owners a simple formula that keeps one bad event from wiping out everything.
This guide explains what each number means, why RAID and cloud sync do not count, and how to build a working setup where your PC backs up to your NAS and your NAS backs up somewhere safe.
What Is the 3-2-1 Backup Rule?
The rule boils down to three numbers that each guard against a different kind of loss.
- 3 copies: Keep your live data plus two separate backups.
- 2 storage types: Put those copies on at least two different devices or kinds of storage, such as a NAS and cloud storage.
- 1 offsite copy: Store at least one copy in a different physical location from the rest.
Photographer Peter Krogh popularized the formula in his work on managing digital photo libraries, and security agencies such as CISA now recommend it as baseline advice. It caught on because anyone can remember it and it works with hardware most people already own.
What Do the 3, 2, and 1 Actually Mean?
Every digit closes a gap that the other two leave open.
Three Copies Remove the Single Point of Failure
If your only backup fails on the same day as your PC's drive, you lose everything. A third copy gives you a second chance. Drives fail at random, so the odds of three independent copies dying together drop to almost nothing.
The word "independent" carries the weight here. Three copies inside one NAS share a single power supply, motherboard, and network connection. One surge or one infection can hit all of them at once.
Two Storage Types Avoid Shared Weaknesses
Identical hardware tends to break in identical ways. A bad firmware update, a faulty USB hub, or a power spike can take out every device of the same kind sitting in one room. Pairing your NAS with cloud storage or a separate external drive means a flaw in one cannot reach the other.
One Offsite Copy Survives a Local Disaster
Fire, flooding, burglary, and electrical damage can destroy your PC and NAS together. An offsite copy sits outside that blast radius. Cloud storage handles this for most people, but a drive kept at a relative's house or your workplace works just as well.
How Does the 3-2-1 Rule Work With a PC and a NAS?
A home NAS slots into the middle of the rule and acts as the hub between your computers and your offsite copy.
| Copy | Where It Lives | What It Protects Against |
|---|---|---|
| Copy 1 | Files on your PC or laptop | Nothing on its own, this is your working data |
| Copy 2 | Your NAS, backed up from the PC automatically | PC drive failure, accidental deletion, Windows reinstall |
| Copy 3 | Cloud storage or a rotated external drive, backed up from the NAS | Fire, theft, flood, or anything that takes out the whole house |
Every PC, laptop, and phone in the house backs up to the NAS. The NAS then sends its own backup offsite on a schedule. One device collects everything, and one job protects it all.
Is a NAS a Backup? Why RAID, Sync, and Snapshots Fall Short
A NAS counts as a backup only when it holds copies of data that also lives somewhere else, and several common features give a false sense of safety.
RAID on Your NAS
RAID keeps your NAS running when one disk dies. It does nothing when you delete a folder by mistake, because the array applies that deletion to every disk instantly. Ransomware, file corruption, and someone carrying off the whole NAS all slip past it. RAID buys you uptime, so you still need a separate backup of the NAS.
Cloud Sync Folders
Dropbox, Google Drive, OneDrive, and iCloud mirror your files across devices. When ransomware encrypts your PC's synced folder, the sync client uploads the encrypted versions and overwrites the good ones in the cloud. Version history can help, but a real backup keeps restore points that changes on your PC cannot touch.
NAS Snapshots Alone
Snapshots let you roll back a share to yesterday in seconds, and they are excellent for recovering from ransomware or a bad edit. They still live on the same disks as your data. If the NAS dies or someone steals it, the snapshots go with it.
Two Drives on the Same Desk
Two external drives plugged into one PC share the same malware exposure, power outlet, and thief. They protect against one drive failing and little else.
How to Back Up a PC to a NAS
Your NAS becomes copy two, so start by getting every computer backing up to it automatically.
Method 1: Use Windows Backup Tools
Windows includes everything you need for basic file and system backups to a network share.
- On the NAS, create a dedicated shared folder for PC backups and a separate user account with access only to that folder.
- In Windows, open Control Panel, go to File History, choose Select drive, then Add network location and point it to the NAS share.
- Turn on File History and set it to save copies every hour and keep them until space is needed.
- For a full system image, use a backup tool like Veeam Agent for Windows (free edition) or Macrium Reflect and target the same NAS share.
- Schedule the image backup weekly so you can restore the whole PC, including Windows and installed apps, after a drive failure.
Method 2: Use Your NAS Vendor's Backup App
Most NAS brands ship their own PC backup software, which handles scheduling and versioning from the NAS side.
- On a Synology NAS, install Active Backup for Business from Package Center, then install its agent on each PC.
- On a QNAP NAS, use NetBak PC Agent or Hybrid Backup Sync to pull backups from your computers.
- Choose which drives or folders to protect, and set a daily schedule.
- Turn on versioning so you can roll back to a point before corruption or deletion.
Method 3: Back Up Macs With Time Machine
Macs can treat a NAS share as a native Time Machine destination.
- Turn on the Time Machine or SMB Time Machine option in your NAS settings for a chosen share.
- On the Mac, open System Settings, go to General, then Time Machine, and add the NAS share as a backup disk.
- Set a size quota on the share so Time Machine does not fill the whole NAS.
How to Back Up Your NAS to the Cloud or an External Drive
This step turns a single NAS into a real 3-2-1 setup, and it is the one most people skip.
Method 1: Send the NAS to Cloud Storage
Cloud storage gives you the offsite copy with no extra hardware to manage.
- Pick a provider that works with your NAS backup app, such as Backblaze B2, Wasabi, AWS S3, or Synology C2.
- Open Hyper Backup on Synology or Hybrid Backup Sync on QNAP and create a backup job, not a sync job.
- Select the shares you cannot replace, including the PC backup share, photos, and documents.
- Turn on client-side encryption and store the encryption password somewhere outside the NAS.
- Schedule the job to run nightly and keep multiple versions.
Method 2: Back Up the NAS to an External Drive
A USB drive attached to the NAS gives you a second storage type and, if you rotate it, a second offsite option.
- Plug an external drive into the NAS's USB port.
- Create a backup job in Hyper Backup or Hybrid Backup Sync that targets the USB drive.
- Run it weekly, then unplug the drive and store it away from the NAS.
- For an extra offsite layer, buy two drives and swap one to a relative's house or your office each month.
Is the 3-2-1 Rule Still Enough Against Ransomware?
The classic rule still covers drive failure, theft, and disasters, but it does not stop an attacker who goes after your backups on purpose.
Modern ransomware hunts for network shares and backup accounts before it encrypts anything. Attackers who get into your PC can often see every mapped NAS drive and log in with saved credentials. If all three of your copies stay online and share one set of logins, a single attack can erase them all, and paying the ransom starts to look like the only option.
Adding one copy that attackers cannot change closes that gap at a small extra cost. The next section covers how.
What Is the 3-2-1-1-0 Backup Rule?
The 3-2-1-1-0 rule adds one offline or immutable copy and zero errors in restore tests on top of the classic formula.
| Rule | What It Requires | Who Needs It |
|---|---|---|
| 3-2-1 | Three copies, two storage types, one offsite | Everyone as a minimum |
| 3-2-1-1-0 | Adds one offline or immutable copy and zero errors in restore tests | Anyone with irreplaceable data or a home office |
Ways to Add the Immutable Copy
You can meet the extra "1" in a few ways on a PC and NAS setup.
- Immutable cloud storage: Turn on Object Lock or an immutable backup option on your cloud bucket so nobody can delete or change files during the lock period.
- Immutable NAS snapshots: Synology and QNAP both offer immutable snapshots that cannot be deleted for a set number of days, even by an admin account.
- Unplugged drive: Keep the external backup drive disconnected except during the backup run.
Lock Down Access
A few account settings stop one stolen password from reaching every copy.
- Do not map the backup share as a drive letter on your PC.
- Use a separate NAS account for backup jobs, and never your everyday admin account.
- Use a different password for your cloud storage account, and turn on two-factor authentication.
- Disable the default admin account on the NAS and keep its firmware updated.
How Often Should You Test Your Backups?
The "0" in 3-2-1-1-0 means you restore files on a schedule and confirm they open, instead of trusting a green checkmark.
- Restore a single random file from the NAS today and open it.
- Each quarter, restore a full folder from the cloud copy to a test location.
- Once a year, pretend your PC is gone and restore its system image to a spare drive.
- Write down how long each restore takes and anything that broke along the way.
Common 3-2-1 Backup Mistakes With a NAS
These errors quietly undo the protection the rule is supposed to give you.
- Treating the NAS as the backup: If the NAS holds the only copy of a file, it is primary storage, not a backup. Anything stored only on the NAS needs its own offsite copy.
- Using sync instead of backup: A sync task to the cloud copies deletions and encrypted files straight across. Use a versioned backup job.
- Forgetting the encryption password: An encrypted cloud backup without its password is unreadable. Keep the password in a password manager and on paper somewhere safe.
- Running out of space silently: Full drives cause failed jobs. Turn on email or push alerts for failed backups and low disk space in your NAS settings.
- Keeping too few versions: Corruption or an infection can go unnoticed for weeks. Keep daily versions for about a month and monthly versions for a year.
Frequently Asked Questions
Is a NAS a backup?
A NAS counts as a backup only when it holds copies of data that also lives somewhere else, such as on your PC. Files stored only on the NAS have no backup until you copy them to the cloud or an external drive.
Does RAID count as one of my three copies?
No. RAID keeps the NAS running through a disk failure, but it copies deletions, corruption, and ransomware damage across every disk instantly.
What is the best backup strategy for a home PC?
Back up the PC to a NAS or external drive automatically, then back that up to cloud storage. That gives you three copies, two storage types, and one offsite copy.
Can I skip the NAS and back up my PC straight to the cloud?
Yes, a PC plus an external drive plus a cloud backup service also meets the 3-2-1 rule. A NAS makes more sense when you have several computers or a large photo and media library to protect.
Is cloud sync like OneDrive or Google Drive enough?
No. Sync services mirror changes, so deleted or encrypted files spread to every copy. Use a backup service or NAS backup app that keeps separate versions.
How often should I back up my PC and NAS?
Back up your PC to the NAS at least daily, and the NAS to the cloud nightly. If you create a lot of new work during the day, set your PC backup to run hourly.
How do I protect my NAS backups from ransomware?
Turn on immutable snapshots on the NAS, use Object Lock on your cloud bucket, avoid mapping backup shares as drive letters, and use separate passwords with two-factor authentication for backup accounts.
