The 3-2-1 Backup Rule for NAS Owners
The 3-2-1 rule: keep at least 3 copies of your data, on 2 different types of media, with 1 copy off-site. Your NAS — RAID and all — is one copy. A realistic home implementation: working files on your PC or the live NAS share (copy 1), a versioned local backup to a rotated USB drive or second NAS (copy 2), and an automated, versioned, encrypted off-site copy — cloud object storage via your NAS's built-in backup app, or a NAS at a relative's house (copy 3). The modern amendment, 3-2-1-1-0, adds 1 offline/immutable copy against ransomware and 0 errors — meaning you actually test restores. And that last part is the one everyone skips: a backup that has never been test-restored is a hope, not a backup.
The one thing to know: The 3-2-1 rule is the standard for real data safety: keep at least 3 copies of your data, on 2 different types of media, with 1 copy off-site. A NAS with RAID is one copy on one device in one building — it satisfies none of the three on its own. A practical home version: the working files on your PC (copy 1), the NAS (copy 2), and an off-site or cloud copy (copy 3). Test a restore occasionally — an untested backup is a hope, not a backup.
What exactly is the 3-2-1 rule?
The 3-2-1 rule is the long-standing convention of the backup industry, and it is precise:
- 3 copies of your data — the original counts as one, so you need two more.
- 2 different media types — or, in modern practice, two independent storage systems, so one class of failure (a bad firmware update, a controller fault, one vendor's outage) can't take out everything.
- 1 copy off-site — physically elsewhere, so a fire, flood, theft, or power surge at your home can't reach it.
Each number targets a different, independent failure mode: extra copies beat device failure, media diversity beats systemic failure, and off-site beats building-level disaster. Skip any one and there is a plausible single event that loses everything.
What is 3-2-1-1-0, the modern amendment?
The backup industry has evolved the rule for the ransomware era into 3-2-1-1-0 — a convention popularized by enterprise backup vendors and now standard advice:
- +1: one copy offline or immutable. Ransomware that compromises your NAS (or your admin credentials) will try to encrypt or delete every backup it can reach over the network. A copy that is air-gapped (an unplugged USB drive) or immutable/write-locked (object-lock on cloud storage, snapshot retention the client can't override) is out of its reach.
- +0: zero errors, verified. Backup jobs are checked and restores are actually tested, because a silently failing job protects nothing.
Why is my NAS only ONE copy?
Because everything that isn't a dead drive hits the whole array at once. RAID (except RAID 0) keeps the array online when a single disk dies — that is availability, not backup. Accidental deletion, ransomware, silent corruption, a failed controller, a firmware bug, theft, fire, and a power surge all destroy the live data and every RAID mirror of it simultaneously. Count your copies by independent devices you could restore from: a 4-bay NAS in RAID 6 is still exactly one copy. This is the single most common misconception in home storage — the full argument is in RAID Is Not Backup.
How does 3-2-1 map onto a real home NAS?
Here is the practical mapping — each row is one copy, the medium it lives on, and the class of tool that maintains it automatically:
| Copy | What it is | Medium / location | Tool class |
|---|---|---|---|
| 1 — Working copy | The live data: your PC's files and/or the primary NAS shares | NAS array (RAID for uptime) + client devices | Sync/central-store apps (Synology Drive, QNAP Qsync class) keep PCs and NAS aligned |
| 2 — Local backup | A versioned backup on separate hardware in the same building | Rotated USB drive, second NAS, or a big desktop disk | NAS backup apps (Hyper Backup / HBS 3 class) or scheduled USB-copy jobs |
| 3 — Off-site backup | A versioned, encrypted copy physically elsewhere | Cloud object storage (B2/S3-class) or a NAS at a relative's house | The same backup apps, targeting a cloud bucket or remote NAS over VPN/relay |
What are realistic second (local) copies?
- Rotated USB drive(s): the cheapest route. A single external drive, backed up to on a schedule from the NAS's USB port. Rotating two drives — one connected, one in a drawer (or better, at work) — gets you a crude offline copy for free. Weakness: it only works if the rotation actually happens.
- A second NAS: the cleanest. Even a retired 2-bay or a single-drive unit receiving nightly versioned backups is a genuinely independent copy — and it's the stepping stone to moving it off-site later.
- A desktop with a large drive: a scheduled versioned backup from the NAS to a PC that's on overnight. Unglamorous, uses hardware you already own.
What does not count: a second folder on the same NAS, a second volume on the same box, or a snapshot on the same array. Snapshots are valuable (below), but they die with the device.
What's a realistic off-site copy for a home user?
Option A: cloud backup to object storage
Every major NAS ecosystem ships a first-party backup application — Synology Hyper Backup, QNAP Hybrid Backup Sync (HBS 3), and equivalents on TrueNAS, TerraMaster, Asustor, and UGREEN — that pushes encrypted, versioned, incremental backups to cloud object storage on a schedule. The service class to look at is B2/S3-style object storage (Backblaze B2, Wasabi, Amazon S3 and its clones) or a NAS-vendor cloud tier: you pay for the storage you use, the backup app handles versioning, and client-side encryption means the provider never sees your data. Cost scales with how much you protect — which is why most people back up the irreplaceable tier (photos, documents, projects) off-site and leave re-downloadable media libraries covered by local copies only.
The sync-vs-backup distinction (this one matters)
Sync is not backup. A Dropbox/Google Drive/OneDrive-style sync service replicates changes — which means it faithfully replicates deletions and ransomware-encrypted files to every synced copy, usually within minutes. A versioned backup keeps prior states you can roll back to; sync keeps the current state everywhere. Sync services' limited version-history windows soften this but are not designed as your last line of defense. Use sync for convenience, versioned backup for safety, and never confuse the two.
Option B: NAS-to-NAS at a relative's house
The homelab classic: a second NAS at a parent's or friend's place, receiving scheduled backups over a VPN (WireGuard/Tailscale class) or the vendor's relay. No per-GB service fee, full control, and it doubles as their backup target too. The honesty clause is bandwidth: home upload links are commonly a fraction of download speed, and the first full copy of a multi-terabyte library over a typical home upload can take days to weeks of continuous transfer. The standard play is to seed locally — do the first full backup with both NAS units on the same LAN, then move the second unit off-site so only nightly incrementals cross the internet. You also become tech support for a NAS you can't physically reach, so pick hardware and software you trust to run unattended.
Where do snapshots and immutability fit?
Snapshots (Btrfs on Synology DSM, ZFS on TrueNAS/QuTS hero) are point-in-time, read-only views of your data that make recovering from deletion or ransomware on the same box fast — minutes, not a full restore. They are the best first line of defense and cost little to run frequently. But a snapshot on the array is not one of your three copies: it dies with the device, and ransomware that gains NAS admin credentials can delete snapshots too. That is what the extra "1" in 3-2-1-1-0 is for: at least one copy that is offline (a rotated, unplugged USB drive) or immutable (object-lock/write-once retention on cloud storage, or snapshot retention enforced on the receiving end of a NAS-to-NAS backup, where the source's credentials can't override it).
What does the "0 errors" part actually require?
Verification is the step nearly everyone skips, and it's why "we had backups" so often precedes "we lost everything." A backup that has never been test-restored is a hope, not a backup. The minimum honest practice:
- Test-restore on a schedule — quarterly is a reasonable home cadence. Restore a few files to a different location, open them, confirm they're intact.
- Use the backup app's integrity checks — Hyper Backup/HBS 3-class tools can verify backup target integrity on a schedule; turn it on.
- Watch the job notifications — a job that has been silently failing for six months protects six-month-old data. Route failure alerts somewhere you actually look.
- Know your restore path before you need it — including where the encryption key/passphrase for your off-site backup lives. An encrypted backup whose key existed only on the machine that just burned down is not a backup either.
What does 3-2-1 cost a home user?
In categories, not dollar figures — costs vary by capacity, provider, and electricity rate:
- Local copy: one-time hardware — a USB drive or a second/retired NAS plus a drive. The cheapest tier of the whole system.
- Cloud off-site: a recurring per-TB service fee that scales with what you protect. Object storage (B2/S3-class) sits at the budget end of the service spectrum; full-service consumer backup products cost more per TB but do more hand-holding. Backing up only the irreplaceable tier keeps this small.
- Remote-NAS off-site: hardware up front, then only electricity — a small always-on NAS draws on the order of a nightlight-to-lightbulb's worth of continuous power (see our power consumption breakdown) — plus your time as remote admin.
Related math: NAS vs cloud storage cost.
Why does automation decide whether this works?
Because manual backups stop happening. Every backup that depends on you remembering — plugging in the drive, clicking the button, rotating the disk — decays within months. The rule of practice: if it isn't scheduled, it isn't a backup strategy; it's a good intention. The built-in tools exist precisely for this: Synology Hyper Backup and QNAP HBS 3 (and their TrueNAS/TerraMaster/Asustor/UGREEN equivalents) run versioned local, USB, remote-NAS, and cloud jobs on schedules with retention policies and failure alerts. Set the schedule once, route the alerts to your inbox, and let the only recurring human task be the test restore.
What's the minimum viable version to start today?
- Tonight: plug a USB drive into the NAS and schedule a nightly versioned backup of the irreplaceable folders. You now have 2 copies.
- This week: point the NAS backup app at a cloud object-storage bucket for the same folders, encrypted, on a nightly schedule. You now have 3-2-1.
- This month: enable snapshots with a sensible retention, enable backup verification, and do your first test restore. You're at 3-2-1-1-0 in spirit — upgrade the offline/immutable leg (object-lock or a rotated second USB drive) as budget allows.
If you're still shopping for the hardware side, NAS-rated CMR drives are the other half of the purchase — see CMR vs SMR or check current NAS drive options on Amazon.
Keep decoding
Frequently Asked Questions
Keep at least 3 copies of your data, on 2 different types of media (or storage systems), with 1 copy off-site. The three copies include the original. The rule works because it protects against independent failure modes: a drive dying (extra copies), a whole device or media type failing (two media types), and a house-level event like fire, theft, or a power surge (the off-site copy). A NAS with RAID is one copy on one device in one building — it satisfies none of the three on its own.
The whole RAID array counts as ONE copy, no matter how many drives are in it. RAID 1/5/6/SHR protects against drive failure inside one box; deletion, ransomware, corruption, theft, fire, and surges hit the live array and every mirror of it simultaneously. Count copies by independent devices you could restore from, not by disks.
Not by itself. Sync services replicate changes — including deletions and ransomware-encrypted files — to every synced copy, usually within minutes. A true backup is versioned and keeps old states you can roll back to. Many sync services offer limited-window version history, which softens this, but a purpose-built versioned backup (to object storage like Backblaze B2 or an S3-class service, or to a second NAS) is the reliable form of the off-site copy.
An industry-evolved amendment to 3-2-1, popularized in the backup-software world for the ransomware era: 3 copies, 2 media types, 1 off-site, 1 copy offline or immutable (air-gapped or write-locked so malware with your credentials can't encrypt or delete it), and 0 errors — backups are verified and test-restored. The additions target exactly the two ways modern backups fail: ransomware reaching every online copy, and backups that were silently broken all along.
Two realistic routes. (1) Cloud object storage or a backup service: your NAS's built-in backup app (Synology Hyper Backup, QNAP HBS 3, and equivalents on TrueNAS/UGREEN/TerraMaster/Asustor) pushes encrypted, versioned backups to a B2/S3-class bucket on a schedule — this is the lowest-effort option. (2) NAS-to-NAS at a relative's house: the homelab classic, with no per-GB service fee, but the first full copy is usually done locally before the second NAS moves off-site, because pushing multi-terabyte data through a home upload link can take weeks.
Actually restoring a few files on a schedule — quarterly is a reasonable home cadence — is the only proof the backup works. A backup that has never been test-restored is a hope, not a backup. Restore a handful of files to a different location, open them, and confirm they're intact; also skim the backup job's logs and verification reports, since 'the job ran' and 'the data is restorable' are different claims.