Data backup strategy

Your recovery point objective should directly drive how often you back up. If your RPO is four hours, a backup that runs once a day doesn't meet it, no matter how reliable that daily backup is.

A widely used guideline is 3-2-1: at least three copies of important data, on two different types of storage, with at least one copy kept offline or otherwise disconnected from the everyday network, so a single incident, like ransomware, can't take out the original and the backup together.

None of this matters if backups are never tested. A backup that's never been restored from is an assumption, not a plan, and assumptions are exactly what fail during a real incident.