3-2-1 is still the rule we explain to clients because a director can remember it. Three copies of the data. Two different types of storage. One of them not in the same room. URBackup is what we usually use to get the local copies done. The off-site copy is a design choice: the other office, a server in Sandton if you are in Pretoria, or another method that is actually off.
A second disk in the same rack is not the '1'. A USB drive in the laptop bag of the person who is on leave is not a process. A cloud sync folder that ransomware can see as a drive letter is often the same copy, encrypted twice.
Retention is the part people skip. If you only keep seven days and the deletion happened on day eight, the rule was theatre. Finance and mail usually need longer than the shared 'fun photos' drive. Say so in the policy.
Then restore something. A file, on a schedule. A full server, less often, into a place that cannot accidentally become the live one. Write the time it took. That number is your recovery time, not the number in a vendor PDF.
ECOMX will do this as a backup audit. If the current system restores cleanly, we will tell you to keep it. The offices are 266 Bronkhorst Street, Nieuw Muckleneuk, and 163 5th Street, Sandown.