Mac

A 3-2-1 backup plan for your Mac

How to build a real 3-2-1 backup for a Mac — three copies, two media, one offsite — using Time Machine plus a NAS and a cloud backup, why a bootable clone is no longer the rescue disk on Apple Silicon, and where iCloud fits (and doesn't).

The 3-2-1 plan mapped to a Mac

Reference images and diagrams. Click any image to view full resolution.

Diagram mapping the 3-2-1 backup rule to a Mac: copy one is the live data on the Mac internal disk; copy two is a local Time Machine backup to an external SSD plus a Time Machine backup to a NAS (two different media); copy three is an encrypted cloud backup offsite. iCloud is sync, not backup. On Apple Silicon a clone is not a bootable rescue disk because recovery is reinstall plus Migration Assistant. Test-restore monthly is the only proof. — Original concept diagram (not vendor copyright). Three copies, two media, one offsite — on a Mac: internal disk + (external SSD and NAS Time Machine) + encrypted cloud. iCloud is sync not backup; an Apple Silicon clone isn't a bootable rescue disk (recovery = reinstall + Migration Assistant). A monthly test-restore is the only proof it works.

Problem summary

I'm here because I want a backup plan that would actually save me — not just Time Machine and a vague hope. The standard that works is 3-2-1: three copies of your data, on two different kinds of media, with one kept offsite. This page maps 3-2-1 onto a real Mac setup (Time Machine, a NAS, and a cloud backup), corrects two common mistakes — thinking a bootable clone is still your rescue disk, and treating iCloud as a backup — and ends with the step everyone skips: testing a restore.

Operator snapshotEvidence first

First proof

Count your copies against failure modes.

Screen to open

System Settings → General → Time Machine → Add Backup Disk

Expected signal

Three copies covering mistake / drive-death / location-disaster.

Stop boundary

Treating iCloud sync as a backup.

Layer path

1A backup plan is judged by failure modes it survives, not by how many backup apps you run. 3-2-1 — three copies, two media, one offsite — exists because each copy covers a different failure: the local drive covers everyday mistakes, a second medium covers a drive dying, and the offsite copy covers a whole-location disaster (fire, theft, flood, ransomware). Counting copies against failure modes is the model.

2Two widespread misconceptions quietly hollow out Mac backups. First, that a bootable clone is the rescue disk — on Apple Silicon clones no longer reliably boot a dead Mac, so recovery is Recovery → reinstall → Migration Assistant, and clone tools become data backups. Second, that iCloud is a backup — it's sync, so deletions propagate and 'Optimize Mac Storage' replaces local files with placeholders.

3The step that converts a plan into protection is the test restore. An untested backup is a hope; backups fail silently (corrupt sparsebundle, stalled cloud client, excluded folder), and the only way to know a copy is real is to restore from it before you need it.

Runbook

Step-by-step runbook

Start here. Do each check in order, compare it to the expected result, and stop when the evidence explains the failure or the safe stop point applies.

Local copy

Check: Time Machine to a local external drive.

Expected result: Fast, versioned, everyday restores.

If not: If no room for a drive, lean on the NAS copy.

Second medium

Check: Time Machine to a NAS over SMB (multiple destinations).

Expected result: A second versioned copy on different media.

If not: If the NAS target is flaky on Tahoe, see the TM-to-NAS page.

Offsite copy

Check: Continuous cloud backup (or a rotated offsite drive).

Expected result: Survives fire/theft/flood/ransomware at home.

If not: If cloud isn't feasible, rotate a drive to another location.

Fix the misconceptions

Check: Treat clones as data backups and iCloud as sync, not backup.

Expected result: Recovery is reinstall + Migration Assistant; real history is TM + cloud.

If not: Don't count iCloud/clone as a backup tier.

Test restores

Check: Restore a file from each copy; rehearse the recovery path once.

Expected result: Every copy is proven to actually restore.

If not: Replace any copy that fails a test.

Decision tree

If: You have only Time Machine (one copy).

Then: Single point of failure — a dead drive loses everything.

Action: Add a NAS copy (different medium) and a cloud copy (offsite).

If: You rely on iCloud as your backup.

Then: iCloud is sync — deletions propagate, placeholders aren't history.

Action: Add real versioned backups (Time Machine + cloud); keep iCloud as convenience.

If: You're keeping a bootable clone as your rescue disk.

Then: Clones don't reliably boot Apple Silicon.

Action: Plan recovery as Recovery → reinstall → Migration Assistant; treat the clone as a data copy.

If: All copies live in the same room.

Then: One physical disaster takes them all.

Action: Make one copy offsite (cloud, or a drive stored elsewhere).

If: You've never tested a restore.

Then: Unknown whether any copy actually restores.

Action: Test-restore from each copy and schedule periodic re-tests.

Evidence

Evidence table

Symptom	Evidence to collect	Likely layer	Next action
Only one backup exists.	Just Time Machine, or just iCloud.	Single point of failure.	Add a second medium + offsite copy.
Deleted file is gone everywhere.	Relying on iCloud sync as 'backup'.	Sync, not versioned backup.	Add Time Machine + cloud backup with history.
Plan assumes booting a clone to recover.	Apple Silicon Mac; external clone.	Clone won't boot reliably.	Recovery → reinstall → Migration Assistant.
Every copy is in the same room.	No offsite copy.	Location-disaster exposure.	Add cloud or an offsite rotated drive.
Backup turns out unreadable when needed.	Never test-restored.	Silent backup failure.	Test restores periodically.

Reference

Commands and settings paths

Add a second Time Machine destination

System Settings → General → Time Machine → Add Backup Disk

Where: Settings on the Mac (local drive + NAS).

Expected: Time Machine alternates between destinations, giving two versioned copies.

Failure means: If one destination misbehaves, the other still holds history.

Safe next step: Keep both; don't let a flaky one be your only copy.

Check Time Machine destinations and status

tmutil destinationinfo ; tmutil status

Where: Terminal on the Mac.

Expected: Lists configured destinations and shows whether a backup is current.

Failure means: A missing destination or stale 'last backup' means a copy isn't running.

Safe next step: Re-add the destination or fix the drive/NAS.

Verify a restore actually works

Enter Time Machine and restore one file (or restore from the cloud client)

Where: Time Machine UI / cloud backup app on the Mac.

Expected: The restored file opens and matches — the copy is proven real.

Failure means: If restore fails, that copy is not trustworthy.

Safe next step: Fix or replace it before relying on it.

Hardware boundary

Hardware and platform boundary

Change only when

Add a cloud backup the moment your only copies are all at home — it's the offsite leg of 3-2-1.
Add a NAS as a second Time Machine destination so two versioned copies happen automatically.

Evidence that matters

At least three copies, on two media, with one offsite.
Versioning + client-side encryption on the cloud copy (ransomware resilience).
A tested recovery path (reinstall + Migration Assistant), not a clone.

Evidence that does not matter

Backup app brand wars — the 3-2-1 structure matters more than the tool.
Clone 'bootability' on Apple Silicon — it's not the rescue path anymore.
iCloud storage tier as 'backup size' — iCloud isn't the backup.

Avoid

Treating iCloud sync as a backup.
Relying on a bootable clone to rescue an Apple Silicon Mac.
Keeping every copy in one location, or never testing a restore.

Related tool/checklist

Use the linked tool when you need a guided plan from your exact symptoms instead of a static checklist.

Backup plan builder

Last reviewed

2026-06-02 · Reviewed by HomeTechOps. Reviewed against Apple's Time Machine backup/restore documentation and Bombich's bootable-backup-deprecation guidance; maps 3-2-1 onto Time Machine local + NAS + cloud, corrects the clone-as-rescue-disk and iCloud-as-backup misconceptions for Apple Silicon, and makes the test restore the step that turns a plan into protection.

Sources/assumptions

Assumes a Mac (including macOS Tahoe / macOS 26, Apple Silicon) where the supported recovery path is Recovery → reinstall → Migration Assistant rather than booting a clone.
Specific products (Backblaze, Arq, CCC, SuperDuper) are examples of categories; the 3-2-1 principle is product-agnostic.
Time Machine multiple-destination behaviour and iCloud sync semantics follow Apple's documentation.

Source-backed checks

HomeTechOps turns official docs and conservative safety rules into a shorter runbook. These links are the source trail for the page direction.

Apple Support: Back up your Mac with Time MachineUsed for the supported Time Machine setup, choosing a backup disk, and that macOS backs up over SMB to a network disk (the sparsebundle model) on modern macOS.Apple Support: Restore your Mac from a backupUsed for the supported restore path (Migration Assistant / macOS Recovery) when a Time Machine backup must be brought back to a new or erased Mac.Bombich Software (Carbon Copy Cloner): Bootable backups have been deprecatedUsed for the Apple Silicon reality that an external clone is no longer a reliable boot/rescue disk; the supported recovery path is macOS Recovery → reinstall → Migration Assistant from Time Machine or a data backup.

Diagnostic rule

1. Check the simplest signal first.
2. Change one thing at a time.
3. Avoid unsafe electrical or data-loss steps.
4. Stop when the evidence says the risk moved.

FAQ

What is a 3-2-1 backup and how do I do it on a Mac?

3-2-1 means three copies of your data, on two different kinds of media, with one kept offsite. On a Mac: copy #1 is Time Machine to a local external drive, copy #2 is Time Machine to a NAS (a different medium), and copy #3 is a continuous cloud backup (offsite). Then test a restore from each — that's what turns 'I have backups' into 'I have backups that work'.

Can I still boot from a clone on an Apple Silicon Mac?

Not reliably — bootable external clones have been deprecated on Apple Silicon. The supported recovery path is macOS Recovery → reinstall macOS → Migration Assistant from your Time Machine or data backup. Carbon Copy Cloner and SuperDuper are still useful, but as data backups, not as a rescue boot disk.

Is iCloud a backup for my Mac?

No — iCloud is sync, not backup. If you delete a file, the deletion syncs everywhere, and 'Optimize Mac Storage' can remove local copies, leaving placeholders. iCloud belongs inside your plan for convenience, but real versioned recovery comes from Time Machine plus a cloud backup. See the iCloud 'Optimize Mac Storage' page for the specific traps.

How many backups do I really need?

At least three copies, because any single copy can fail. Two should be on different media (so one failure mode doesn't take both), and one must be offsite (so a fire, theft, or flood can't wipe out everything at once). For most people that's Time Machine local + Time Machine to a NAS + a cloud backup.