Ransomware operators target backup repositories first. Immutability - write-once storage that cannot be altered or deleted for a fixed retention window - is the single control that keeps a recovery possible.
Test quarterly
Restore a real workload to an isolated network, boot it, log in and open the application. Record the time taken. That number is your real RTO.