Once you have policy and procedures in place you should deploy the backup system

Means protecting backups

It is at this stage where most bad guys break into your stuff and screw it all up.

You need protect the backup system at all times and most involve shared responsibility