#1 Use Snapshots
#2 Remove the Backup Servers From the Windows Domain
#3 Segment Access to the Backup Servers
#4 Require MFA for Access
#5 Leverage an Immutable Data Repository
#6 Enforce the Principle of Least Privilege
#7 Encrypt Backups
#8 Leverage Long-Term Cold Storage