There are two kinds of companies: those that do backups, and those that will start after their first data loss. There is no third option. Disks fail sooner or later, someone deletes the wrong folder, and ransomware doesn't pick victims by company size.
The 3-2-1 rule, in plain language
3 copies of your data. The original plus two backups. One copy is not a backup. It's hope.
2 different media. For example, one copy on a network device (NAS) in the office, another in the cloud. If a failure hits one technology, the other survives.
1 copy off-site. Fire, flood, theft: anything that destroys the office also destroys the backup sitting next to the server. That's why at least one copy must live physically elsewhere, most often in the cloud.
All of it has to happen automatically. A backup that depends on someone remembering doesn't exist.
The detail that decides against ransomware
Modern ransomware hunts down backups and deletes them first, and only then encrypts your data. A serious strategy therefore includes at least one immutable or offline copy, a backup that even an attacker with full access to your network cannot delete or alter. That's the difference between an unpleasant day and an existential problem.
A backup nobody has tested doesn't exist
The worst moment to discover that recovery doesn't work is the moment you actually need your data. We've seen backups that "completed successfully" for months, while copying empty folders. So: recovery gets tested periodically, on a schedule, with the duration measured. If restoring a server takes three days, you want to know that today, not mid-crisis.
Three questions for a self-check
First, if your main disk fails right now, how much data do you lose: an hour, a day or a week? Second: how long would a full recovery take? Third: does anyone in the company know reliable answers to the first two questions?
If the answer to the third is "not really", it's a sign it's time to talk about backups. A well-built system runs quietly in the background and costs less than a single day of downtime. Guaranteed by experience.