Almost everyone has backups. But in the moment of crisis — ransomware, disk failure, human error — the real question is different: how long until you’re back?
Two numbers decide your fate: RTO (how long you can be down) and RPO (how much data you can lose). Without defining them, any backup is just a false sense of security.
The 3-2-1 rule still holds: three copies of your data, on two types of media, one off-site. Most important of all: periodic restore tests — a backup that has never been restored is not a backup.
A written disaster recovery plan, with a named owner and an annual drill, is the difference between a few hours of downtime and weeks of disaster.