we copy our backups to an external drive, they're unencrypted, if an attacker steals this drive is the data exposed

we used to keep backups on unencrypted disks too... then we started encrypting them

Windows: BitLocker. Mac: FileVault. Linux: LUKS. Encrypt all external devices.

I felt relieved reading this answer, so it's not just me. The biggest time-waster for us was not knowing who had the final say.

I'm also curious if anyone does it differently.

I went through the same thing.

It's rare to find an explanation this clear.

I completely agree. Trying to do this alone is the most expensive way.

When making a decision, first look at what data you have on hand. Proven by experience.

Let me summarize the topic, since several different answers were given. If you scold false alarms, nobody will report again.

If permission and scope aren't in writing, don't start that test. If you have questions, write them; I'll answer as best I can.

I disagree with you on this point. Processes without records never improve because you don't know what to fix.

If I were you I'd go this route.

I completely agree. Having backups accessible on the same network and with the same identity makes them part of the target.

If I were you I'd go this route.

Quick summary for newcomers: If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

When we decide without measuring we always end up in the same place. That's all sorry if I went on too long.

Following.

Correct.

Let me summarize the topic since several different answers were given. Most time waste accumulates in tasks waiting for approval.

If I were you, I'd go this route.

I partly agree, partly disagree. Trying to do this alone is the most expensive way.

Everything goes well for the first three months; problems arise in the fourth. If I were you, I'd go this route.

I agree, and I'd like to emphasize that. Having backups accessible on the same network and with the same identity makes them part of the target.

That's all, sorry if I went on too long.

I agree with this. Everyone rushing into backup encryption gets stuck at the same point.

If you have questions, write them; I'll answer as best I can.

Timely topic.

Saved. Trying to do this alone is the most expensive way.

That's all sorry if I went on too long.