The rule that still works
Three copies, two media types, one offsite. Add one immutable copy and ransomware can no longer take your backups with it.
GABCO field practice

Almost every firm has backups. Far fewer have restored from them recently. A recovery you have tested, timed and documented is the only kind that counts during a ransomware attack or after a storm.
Three copies of your data, on two types of media, with one offsite.
Backups that cannot be changed or deleted for a set period, even by an administrator account.
Copies held away from the island's single points of failure.
How much data you can afford to lose and how fast each system must return, agreed with management.
Scheduled restores of files, servers and whole systems, timed and recorded.
Step by step recovery for each critical system, with owners and contacts.
Systems, data and recovery needs reviewed.
Backup and replication built to 3 2 1.
Restores run and timed.
Daily checks and regular retesting.
Three copies, two media types, one offsite. Add one immutable copy and ransomware can no longer take your backups with it.
GABCO field practice
Hurricane Ivan damaged most buildings on Grand Cayman in September 2004. Backups stored in the same building did not help.
Source: Cayman Islands Government
Test individual files regularly and full system recovery at least annually, and after major changes.
It is a strong offsite copy, but restoring large systems over the internet can be slow. A local copy for fast recovery plus an offsite or cloud copy is usually best.
A backup that cannot be altered or deleted until its retention period ends, which stops ransomware attackers destroying your recovery options.
Tell us what you're working on. We'll listen, ask the right questions and recommend a practical next step. No obligation.