Qwik 
A hard disk gives no warning before it fails. Nor does ransomware, a water leak, or the colleague who overwrites the wrong folder. The question is not whether you will lose files one day, but what you will have to hand on that day.
What the rule says
- Three copies of your data: the original and two backups
- Two different media: for example a network drive and online storage
- An off-site copy: somewhere other than the building where the originals are
Why three, and not one
A single backup is just one more point of failure. We regularly see backups that had not run for months without anyone knowing: disk full, password changed, software disabled by an update. With two independent backups, it takes two silent failures at the same time to lose everything.
Why off site
A backup disk sitting next to the server shares its fate: theft, fire, power surge, flood. And if it is permanently connected, ransomware encrypts it along with everything else. The off-site copy must be out of reach, physically and from the network.
Synchronisation is not a backup
OneDrive, Dropbox, iCloud or Google Drive copy your files elsewhere, but your mistakes too: a deleted or encrypted folder is deleted or encrypted everywhere, a few seconds later. A backup keeps dated versions that nothing happening to the original can change.
The point people forget: restoring
A backup that has never been restored is a hypothesis. Once a quarter, pick a folder at random and actually restore it. Once a year, do the exercise with a whole computer. Note how long it takes: that is how long your business would be at a standstill.
In practice, for a small organisation
Workstations backed up every night to a network drive at the office; that drive copied, encrypted, to hosting in Switzerland; Microsoft 365 backed up separately; an alert as soon as a copy fails. For a private client: an external disk that is unplugged after use, and an online backup.
In short: three copies, two media, one elsewhere, and a restore test from time to time. Our backup service applies this rule and sends you the test reports.