Lots of good info here - it's also worth pointing out that if you're compromised, you may not have all the backups you think you do. A lot of the attackers out

Lots of good info here - it's also worth pointing out that if you're compromised, you may not have all the backups you think you do. A lot of the attackers out there are adding the step of disabling and deleting local snapshot-style backups as part of their attack, because they don't want all their hard work to get thrown out the window with a simple OS-level rollback (side note - if your endpoint security vendor tries to sell you rollback as a ransomware protection feature, run). For this reason, data backed up to tape or some other physical media that gets removed is much more likely to survive a breach than volume shadow copies and snapshots. Test the hard stuff!