My general rule is that there are at least 3 copies in different physical locations, at least 2 of which are not within "tornado distance" of each other.

The way to think about backup and DR is "what would it take to destroy all of this?" and keep making the answer more and more extreme until it is so horrible that if it actually happens you won't care about what you lost.

PS: Also always remember that a backup you don't test isn't actually a backup.