Decide what to protect
Document databases, user files, application configuration and secrets. Use database-aware backups rather than copying active database files blindly.
Keep an independent copy
Keep at least one backup outside the server it protects. Encrypt sensitive data and restrict access to backup credentials.
Test recovery
Restore into a separate environment periodically. Record the time needed, verify the application and adjust your recovery plan when the workload changes.