The standard
Highly available production infrastructure is normal now. Backup infrastructure much less so, even though in a real incident it is the only one that still counts. It should be the equal of the primary: secure, fast, solid, scalable.
3-2-1-1-0
Three copies, on two kinds of media, one of them off site, one of them immutable, and zero errors on the restore test. The last two digits are the ones missing in practice.
Immutable is the answer to ransomware. A backup an attacker can delete with the same credentials that reach production is not a backup at the moment it matters.
Zero means tested. A backup whose restore has never been exercised is an assumption.
What it protects against
Against deleted data, by users as much as by attackers. Against hardware failure. Against insiders. And against the loss of a whole data centre site, which is rare and takes everything else with it at the same time.
How we build it
To your requirements, with products that complement each other rather than overlap. Daily operation stays simple: restores, checks and expansions without specialist knowledge.
The measure is the RPO and RTO from the requirements. The backup storage and the backup server are sized against them, because a restore that misses the deadline is not one. Offloading backup data to the cloud runs on S3 object storage, stored immutably.


