The 3-2-1 rule is a simple standard for resilient backups. The original plus two backups means a single failure does not lose data. Two different media or services protect against one kind of failure affecting both, and an offsite copy protects against fire, theft, or a site-wide outage.
Ransomware has added a fourth consideration. At least one copy should be immutable or offline, so an attacker who gains administrative access cannot delete or encrypt it. Most importantly, backups must be tested by actually restoring data on a schedule.