Attackers target backups first. Backups need to be isolated, immutable and tested. Online backups reachable with domain credentials are often deleted before encryption starts.
What this means in practice
A useful test is to ask who would act on this tomorrow morning and what they would need. If the answer is unclear, the gap is organisational rather than technical, and that is usually the cheaper one to close.
Key actions
- Keep at least one offline or immutable copy
- Use separate credentials for backup systems
- Test full restores, not just single files
Next steps
Know how long a full restore takes. That number drives your recovery plan. Keep the first version short. A one-page routine that people follow beats a long document nobody reads.