3-2-1: 3 copies of data, on 2 different media, with 1 copy off-site.
Common tools: Veeam (great for VMs), Datto (BCDR (Business Continuity and Disaster Recovery) appliance + cloud), Acronis. M365 (Microsoft 365) data needs its own backup — Microsoft doesn't back it up for you long-term.
An untested backup is not a backup. Schedule monthly restore tests.
