A backup answers the question "do we still have the data?" Disaster recovery answers "how quickly are we working again?" Many organizations have the first and assume they have the second.
Set two numbers per system
Recovery Point Objective (RPO) is how much data you can afford to lose. Recovery Time Objective (RTO) is how long you can afford to be down. These two numbers drive backup frequency, storage design and whether you need a secondary site.
Make backups ransomware-safe
Keep at least one immutable or offline copy that attackers can't encrypt, and store a copy off-site or in the cloud.
Rehearse
A recovery plan that has never been tested is a hope, not a plan. Schedule restore drills at least twice a year and record the results.
