Encrypt, encrypt, encrypt, encrypt, encrypt, encrypt, encrypt, encrypt, encrypt, encrypt,...
I favor PGP/GPG with 4096-bit keys.
could -> cloud
My backups are IPSEC encrypted at rest first, transferred over encrypted protocols, and then encrypted again on Microsoft’s Azure system. Only I have the certificates used to encrypt the first time, and I use 4096 bit keys.