Heya,
It depends on what it is and how important it is. There's also a division between uptime and actual backups.
If your drive image, or any data set, is not actually truly important and you're just worried about uptime, ie, not having to painstakingly re-install or re-download a bunch of stuff, then it's not critical to maintain a huge array of backups spanning time. You can keep two backups of these data sets, one before you changed something, one of the newly changed something. If it's just uptime, you can get away with probably 1 copy that is physical separate from the live copy. Obviously it depends on total size and capacity. But if you're looking to just clone a drive that is a live copy of data, including an OS, software, etc, then this is a simple uptime issue and can be restored rapidly onto a new drive as needed from the separated physical copy. You can take it next level by making that physical copy redundant or adding a 3rd separate physical copy to get very high uptime potential. The more disconnected it is, the more work you have to do to complete a disc image and restore it though. So how you separate the data can impact how secure it is, if you care about that.
If you're more talking about physical backups, that's going to be complex and it depends on how important the data is. You should most likely at least have 3 physical separated copies of the data, and at least one of those are likely redundant and I would stress at least one of them to be cold, ie not connected in any way to any intranet or internet so that it's impossible to remotely access and can only truly be accessed physically. This doesn't have to just be drives, and can include other storage media, from cloud services (but beware the potential disappearance of said service and potential security risk if you're not encrypting and the time factor of requiring internet for upload/download of your data with zero guarantees either way) to things like optical storage. I bring up optical, because despite it being a great physical way to backup data for a long period of time, it acts like cold storage in that it's not something that can be held ransom and you can encrypt it and its totally offline (cold) in storage.
And you can combine the two, so you have uptime factors and security of backup factors by taking it another physical separated step each time. This is the idea behind 3, 2 and 1 but by altering how its implemented for rapid access and use (uptime) versus security and redundancy (backup).
An example would be your live copy in the living system (1). You clone that disc image at whatever interval you think necessary to an intranet connected NAS that is mirrored (redundant) and has high level security requiring one or two method input for access (ie, passworded); this is your rapid access uptime factor with an element of backup to it for a hybrid approach (2). If you need true backups of this data, this is where you then split off to a completely cold and separated physical 3rd copy, onto a storage media that is also for keeping off site, such as a physical drive (risky) or something like optical storage (much less risky, more accepted as a standard and commonly used for this purpose and can be higher capacity now) (3). You would likely want to encrypt this as well and again store it off-site. You can take this a step farther, with a separate copy again, doubling it, with two separate off-site locations, making a 4th physical copy that is separated (4) and then rotate things. Obviously (3) and (4) require effort on your part to physically store/encrypt the media and move it off-site safely. You can mix cloud into this at any point as long as it's not the only physically separated copy and is encrypted. The hard part becomes how often you want to perform backups and rotate these distant copies. And lastly, and honestly most critical, is you have to actually be able to restore your data from any of these data sets reliably (this is usually totally forgotten or not given enough real thought; ie, have you actually performed it? Do you know how to do it? Was it successful? Is the data actually verified?).
Very best,
Facebook
Twitter