Servers and PCs
Image-level backups so a failed machine can be rebuilt, not just its files.
Microsoft 365
Mail, OneDrive, SharePoint, and Teams backed up outside Microsoft.
Protected copies
At least one copy stored where ransomware on your network can't reach it.
Restore tests
Real restores on a schedule, with the results recorded.
Recovery plan
Who does what, in what order, written down before you need it.
Reports
Plain-English status you can hand to an insurer or auditor.