Depends on your paranoia/fault tolerance level. In general some form of the 3-2-1 backup rule. Personally I use arqbackup:

1. Local live copy
2. Hourly differential backups to another network share
3. Hourly differential backups to an s3 compatible bucket with with object lock and versioning so malware can’t wipe the latest 3 months or so.