You will need to choose backup software and decide the backup method. We back up our Exchange server data bases to tape. Netbackup is a good application for backups but there are many others. Are you backing up other servers? Whatever you are using to back up other servers can be used for Exchange as well most likely.
Another thing to keep in mind is if people delete mail during the day that deleted mail will not be backed up that night. To meet your retention policy requirements you may also want to investigate a corporate archiving solution like Quest Archive Manager or something else. These will capture all mail whether it gets deleted by the user or not and then you can set a retention on it for as long as required. This will of course involve a significant financial investment, but if the retention is required then money will have to be spent to meet that requirement.