3-2-1 means three copies of data (live + backup + another backup), on at least two media types (e.g. disk + cloud or tape), with one copy off-site. The goal is to survive fire, theft, ransomware, and admin mistakes.
Copying to a NAS in the same room often fails — ransomware typically encrypts reachable network shares under the same credentials as production. A separate cloud account or air-gapped tape changes outcomes dramatically.
RPO, RTO, and buying the right tier
RPO is how much data you may lose — driven by backup frequency. RTO is how fast you must be back online. A small shop may tolerate a day without ERP; manufacturing with MES often needs hours, not weeks.
Without those two numbers it is hard to judge whether nightly cloud backup is enough or you need near-continuous VM replication.
Restore, not just backup
Backups without tested restores are wishful thinking. Periodically restore a random file or a full VM and measure time — you need to know if recovery is minutes or days.
Immutability (snapshots, WORM, locked buckets / object lock) helps against attacks that silently corrupt backups for weeks before detonation. Bidirectional sync folders pretending to be “backup” often get encrypted too — prefer one-way push or append-only designs.