Depends on your paranoia/fault tolerance level. In general some form of the 3-2-1 backup rule. Personally I use arqbackup:
- Local live copy
- Hourly differential backups to another network share
- Hourly differential backups to an s3 compatible bucket with with object lock and versioning so malware can’t wipe the latest 3 months or so.