[phone[phone]]

321 rule for backups: 3 copies, 2 different media, at least 1 off site

Something is not a backup if you haven't tested that you can restore from it.

All backups not in your direct physical possession should be encrypted before being written.