File sync is also not backup, and this causes more actual loss than the first misunderstanding. Sync is obedient. Delete a file and it deletes everywhere. Overwrite a document with a worse version and the worse version propagates. Encrypt your folder with ransomware and the encrypted files sync cheerfully to every device you own. Replication copies whatever state exists, including a bad one. Backup keeps earlier states you can return to.
The rule worth following is three copies of anything that matters, on two different kinds of storage, with one somewhere else entirely. For a small business that means the working copy in the service you use daily, an automated backup to a separate service that keeps history, and a periodic copy on an external drive that spends most of its time disconnected. The disconnected copy is the one that survives ransomware, because anything connected during an attack is a candidate.
What needs protecting is broader than files. Your customer list, your accounting data, your email, your website and its database, contracts, and photographs of completed work. Add your domain registration, which is not data but is the fastest way to lose a business identity permanently.
Then test it. Pick a file you can identify from three months ago and restore it. Most people discover the backup was not running, covers less than assumed, or that they do not know how. A backup you have never restored from is a belief about a backup.
Decide how much you can afford to lose and how long you can afford to be without it, because those two numbers determine everything else. If losing a day of work is survivable, daily backups suffice. If losing an hour of transactions would be serious, you need something continuous, which most payment and accounting platforms already provide. Retention matters as much as frequency and gets less attention: keeping only seven days means an error introduced eight days ago now exists in every copy you hold.
Include the things that are not files, since those are what people forget until they are gone. Your domain registration details, a list of which accounts hold what, the credentials in your password manager, and any two factor recovery codes. A perfect backup of your documents is little help if nobody can reach the account they are stored in.