Most businesses learn their backups were failing on the worst day of their year. The 3-2-1 rule is cheap insurance against that.
The day everyone finds out
Every ransomware story I've been pulled into has the same plot twist. The business refuses to pay, reaches for its backups, and discovers the backup job died in March. Nobody looked, because somebody had once said "backups are handled" and everyone believed it. I have seen the logs on servers we took over: six months of failed jobs, every one of them silent. A backup you have never restored from is not a backup. It's a hope with a schedule attached.
3-2-1, plainly
The rule everyone quotes, because it earns its keep: three copies of your data, on two kinds of media, one copy off-site. The off-site copy is the one that saves you. The external drive sitting next to your server shares its fate: same power surge, same theft, same ransomware, which lives wherever your credentials live. A cloud copy that your production server cannot reach from the inside is what turns a disaster into a bad week instead of the end of the company. Then test it. A restore run once a quarter, even just one file, catches the silent failures while they're still cheap.
What to ask your host
Olorun Cloud hosting includes automated daily backups kept off-server, and we run restore tests, because "we have backups" is a claim and a tested restore is a fact. Whatever host you use, ask three questions this week: when did you last test a restore, where do the backups physically sit, and can something that compromises my server also reach them. Vague answers are answers too.
One thing before you close this tab: pick a backup you personally are responsible for, restore a single file from it, and look at the date on the last successful run. Fifteen minutes. Better to find a broken backup on a boring Tuesday than on the worst day of your year.