Security & recovery
Backups are not recovery.
The sentence “we have backups” answers only one small part of the recovery question.
The useful questions are harder: Are the backups isolated? Has anyone restored from them recently? Which systems return first? Are the credentials and documentation needed for recovery available if the domain itself is compromised?
A backup product stores data. A recovery plan restores business operations in a deliberate order. That difference becomes painfully visible during ransomware, hardware failure, or a major identity compromise.
Discuss this with Jaen