A storage system secures system redundancy through a simple configuration. A primary storage control device and first secondary storage control device are connected by a synchronous method, and the primary storage control device and a second secondary storage control device are connected by an asynchronous method. The primary storage control device sets control numbers for update data, and saves journal data. The primary storage control device transmits the update data to the first secondary storage control device. The first secondary storage control device writes update data to a first secondary volume, and uses a plurality of bitmap tables to manage differences. If the primary storage control device stops operation, the first secondary storage control device becomes the new primary storage control device. Differential copying is performed from the first secondary storage control device to the second secondary storage control device.