I second this. Also if you have particularly large databases consider snapshots to improve recovery speed. Also consider air gapped backups, just incase your primary backup appliances are compromised

Edit: also focus on your business continuity plan. Organizations often expect after an attack to have their systems down for a day or two, they won't be. It could be weeks or months before everything is back up and running. You need to know how you're going to run your business in the interim