Keep three copies of anything you care about, on two different kinds of media, with one of them off-site. The reasoning is that backup failures are usually correlated: the same flood, theft, power surge, ransomware or mistaken deletion that takes the original often takes a backup sitting next to it. An external drive at home plus an encrypted cloud copy satisfies this for most people, and is far more robust than either on its own.

Ransomware deliberately looks for backups, and anything permanently mounted or continuously synced is reachable by whatever is running on your machine. Keep at least one copy physically disconnected between backups, or use a service offering immutable or versioned storage that the client cannot retroactively delete. Sync services like Dropbox or iCloud are not backups on their own - they faithfully replicate deletions and encryption to every device.

A backup is a complete copy of your data with none of your device's protections around it. Encrypt it before it leaves your control: most backup software offers this directly, and Cryptomator or VeraCrypt can encrypt what a provider does not. Store the backup passphrase somewhere separate from the backup itself - losing it makes the backup as useless as not having one.

This is the step nearly everyone skips, and the reason most backup strategies fail at exactly the wrong moment. A backup job reporting success proves only that files were written - not that they can be read back, not that the encryption passphrase still works, and not that the set is complete. Once or twice a year, restore a handful of files to a different machine and open them. Far better to find the problem now.

A backup that depends on remembering to run it will be weeks out of date when you need it. Schedule it, and check the job's own reporting occasionally, so that a silent failure doesn't go unnoticed for months.

Recovery is the back door to every account, and it is routinely weaker than the front. A password manager and a hardware key protect nothing if the account will also let anyone holding your phone number, or knowing your mother's maiden name, reset it. Audit the recovery methods on your important accounts: remove SMS where a better option exists, make sure the recovery email is itself an account secured to the same standard, and treat security questions as extra passwords - store random answers in your password manager rather than facts a data broker sells.

Backup codes solve exactly one problem: losing your second factor. That makes storing them only inside the account they unlock, or only on the phone that is the second factor, self-defeating. Print them and keep them somewhere physically secure, or store them in a password manager you can reach from another device. Whichever you choose, confirm you could get to them from a borrowed computer with nothing of your own to hand - because that is the situation you will be in.

Decide the order of operations before you need it, because the first hour matters and panic is a poor guide. Broadly: get onto a device you trust; change the password on your email account first, since it controls the resets for everything else; then revoke active sessions and application tokens rather than only changing passwords, because a stolen session cookie survives a password change. Work outwards to financial and social accounts, check for recovery addresses or mail-forwarding rules the attacker may have added, and contact your bank directly if money is involved. Only then worry about how it happened.