Backup isolation

A backup only helps if it survives the thing that destroyed the original.

That sounds obvious and is routinely missed. Backups reachable from the environment they protect, using credentials that exist in that environment, are backups an attacker can find and delete, and modern ransomware crews look for them first, because deleting them is what makes the ransom worth paying. The test is not whether a copy exists. It is whether that copy could be destroyed by somebody who already has full control of everything else.