Use three copies, two media types, and one offsite copy as a starting point. Keep a copy offline or appropriately protected from alteration, separate backup access from everyday access, and regularly test integrity and restoration. Offsite storage alone does not protect a backup from ransomware.
“Three copies, two media, one offsite. Memorize it.”
Sources for this correction, checked October 17, 2026: https://www.cisa.gov/stopransomware/ransomware-guide ; https://www.ic3.gov/CSA/2023/230523.pdf