The three questions
What is being backed up? Name the machines and the systems, not the folders. Most offices discover that the laptops, the accounting database and the one shared drive somebody set up in 2019 are outside whatever runs at night.
Where does the copy live, and can it be reached from your office network? A copy that your computers can open is a copy that ransomware can open. At least one backup has to sit somewhere your day-to-day network cannot write to.
When did somebody last restore from it, and how long did it take? That is the question that separates a backup from a hope. Ask for the date and the result in writing.
Where backups quietly fail
The drive sits on the shelf beside the server, so the fire, the flood or the theft takes both. The job stopped four months ago and the failure email goes to somebody who left. File sync is mistaken for backup, so a deletion syncs within seconds and an encrypted file syncs just as fast. A database is copied while it is open, and the copy is unusable. One computer is covered and eleven are not. And the most common one of all: everything runs perfectly and nobody has ever tried to bring a file back.
Every one of these looks fine on a status screen. That is what makes them expensive.
The rule of three, in plain words
Keep three copies of anything you cannot lose. Keep them on two different kinds of storage. Keep one of them away from the building and out of reach of your network. It is an old convention in this trade because it survives the three things that actually happen: hardware failure, a burst pipe, and an attacker who gets in with a stolen password.
What a proper restore test looks like
Pick a file at random, from a date you choose rather than one you are offered. Have it restored to a separate location, so nothing live is overwritten. Open it and check the contents. Write down the date, who did it and how long it took. Do that quarterly for files, and once a year for the big one: a whole system brought back onto different hardware.
Time the big one honestly. The number you get is how long your business would be closed.
The question behind the question
How long can your business run without its files, and how much work can you afford to redo? Those two answers set what your backups have to do. An office that can lose a morning needs something different from a clinic that cannot lose an hour, and the cost follows from that rather than from a product name.