These are somewhat orthogonal issues.

1. Test and encrypt backups.

2. Don't get hacked. Defense-in-depth philosophy and rigorous, routine social-engineering training/testing. If you get hacked, it's usually game over. Defend systems like the business depends on it because it does.

3. Limit exfil: extra security for PII, exfil detection, and [HN]I[DP]S.