Cloud Sync Is Not a Backup: How to Build a Practical 3-2-1 Backup for Your Home Data

OneDrive, Google Drive, iCloud, Dropbox, and Google Photos are excellent at keeping data available across devices. That convenience often creates a dangerous assumption:

“It is in the cloud, so it is backed up.”

Sometimes it is recoverable. Sometimes version history or a recycle bin can save you. But synchronization and backup solve different problems.

What cloud sync actually does

A sync service tries to keep multiple locations consistent.

If you edit a synchronized document on your laptop, the new version reaches the cloud and other devices.

If you delete a synchronized file, that deletion can also propagate.

If ransomware encrypts files inside a synchronized folder, encrypted versions can upload too.

Good cloud platforms provide recovery tools, but they should not be your only protection against every failure.

What a backup does differently

A backup preserves a separate recoverable copy.

Ideally, that copy is protected from ordinary changes to the working data.

A file deletion on your laptop should not immediately and permanently remove every backup copy.

The 3-2-1 rule

CISA/US-CERT guidance describes the classic 3-2-1 approach:

• 3 copies of important data: one primary and two backups.
• 2 different media/types to reduce common failure risk.
• 1 copy offsite so theft, fire, flood, or local disaster does not destroy every copy.

You do not have to implement this like a data center. A home version can be simple.

A practical home 3-2-1 example

Imagine your family photos and important documents live primarily on your computer.

You could keep:

1. The working files on the PC.
2. An automatic backup on an external USB drive.
3. An encrypted cloud backup or second copy stored offsite.

That already gives you separate failure domains.

But I already use OneDrive or Google Drive

Great—keep using it.

Cloud sync is valuable because it protects against laptop loss and makes files accessible from another device.

Just add another independent backup.

For example:

• Working copy inside OneDrive.
• External File History/Time Machine backup.
• Cloud provider’s own recycle/version history as an extra recovery layer.

Before relying on File History or Time Machine for cloud folders, download the actual files locally and verify they are included in a test restore. Online-only placeholders are not independent file backups.

The external backup should not be permanently writable from every device if ransomware is your concern.

Photos deserve special attention

iCloud Photos and Google Photos are primarily synchronized/cloud photo-library services.

If you accidentally delete a synchronized photo, that deletion can propagate through the service.

Recently Deleted/Trash gives you a recovery window, but that is not the same as keeping an independent archive.

For irreplaceable family or professional photos, periodically export another copy to external storage.

What counts as two different media?

Examples include:

• Internal SSD + external hard drive.
• Computer + NAS.
• External disk + cloud backup.
• NAS + rotated offline drive.

Two partitions on the same physical SSD do not meaningfully protect against physical drive failure.

Offsite is about location risk

If your laptop and both backup drives are in the same bag when it is stolen, you have three copies but one disaster.

An offsite copy can be:

• A reputable cloud backup service.
• An encrypted drive stored at another trusted location.
• A second NAS/location with protected replication.

What about a NAS?

A NAS is excellent for central household backup, but the NAS itself also needs protection.

RAID is not backup. RAID can keep a NAS running after one disk failure; it does not automatically protect against deletion, malware, theft, fire, or array corruption.

Back up critical NAS data somewhere else too.

Offline or immutable backups matter against ransomware

CISA repeatedly recommends maintaining offline or otherwise separated backup copies for ransomware resilience.

If malware can reach every mounted backup and cloud credential from the compromised computer, it may be able to damage more than the working files.

Options include:

• Rotating USB drives and keeping one disconnected.
• Immutable/version-locked cloud backup.
• NAS snapshots protected from normal user accounts.

Use automatic backups where possible

The backup you have to remember every Friday will eventually be forgotten.

Use:

• Time Machine on Mac.
• File History or another backup product on Windows.
• Phone cloud backup.
• Automated NAS backup.
• A dedicated cloud backup client.

Automation improves consistency. Separation improves resilience.

Encrypt portable backup drives

A backup drive contains the same sensitive information as the computer.

If you carry or store it offsite, use BitLocker To Go where supported, an encrypted APFS external volume on Mac, encrypted backup software, or another appropriate encryption method.

Then store the recovery key somewhere independent.

Do not forget app-specific data

Your important information may be outside Documents/Pictures.

Consider:

• Password-manager emergency kits.
• Email archives.
• Accounting files.
• Game saves.
• Browser profiles/bookmarks.
• Virtual machines.
• Development repositories not pushed remotely.
• Authenticator recovery information.
• Phone voice recordings.

Test restores

A green “Backup completed” message is reassuring, but restoration is what matters.

Every few months:

1. Choose a harmless test file.
2. Restore an older version.
3. Open it.
4. Confirm the backup contains what you expected.

For major backups, occasionally verify from a different machine or recovery environment.

Keep backup credentials recoverable

If your cloud backup uses MFA, make sure you have backup codes or another factor stored separately.

If your encrypted backup relies on one password stored only in the same failed computer, recovery can become impossible.

A realistic household plan

You do not need ten products.

A very strong basic setup might be:

• PC/Mac working data.
• Cloud sync for active documents and photos.
• Automatic external-disk backup.
• One offsite/cloud backup for irreplaceable data.

Sync is useful; backup is insurance

Cloud sync helps you continue working when one device disappears.

Backup helps you recover when the data itself disappears or becomes wrong.

Use both.

Official references

CISA — Data backup optionsOfficial reference CISA — StopRansomware guideOfficial reference