Layers and looking at what the business needs to achieve for business continuity and recovery. How quickly do you need to restore services after a major incide

Layers and looking at what the business needs to achieve for business continuity and recovery. How quickly do you need to restore services after a major incident (natural disaster to internal user with God access)? What is an acceptable amount of data loss at any point in time? What are your legal obligations? Then finally, compare the financial/social/legal impact of those events against what the company will allow against what it can afford. This same conversation should tie directly into your Service Level agreements/uptime goals. Simple? Nah, doing this properly is an entire department/role (CISO) plus other groups. Some quick practical basics. - The fewer things, the smaller the potential attack surface. - NIST publishes some good starting points https://www.nist.gov/cyberframework - Shared credentials are evil. All admins should be operating off their own accounts - MFA and SSO - A backup isn't a backup if you haven't validated you can restore it - Replication isn't backup. You need something that is immutable and has history. To start I would suggest a nightly backup, with each backup retained for 45 days at minimum. GDPR complicates this with right to be forgotten but this is a starting point.