Regular copies of data and configuration kept somewhere separate, together with a tested procedure for restoring them.
The question is never whether you have backups — it is whether anyone has ever restored one. Untested backups fail exactly when they are needed.
We automate backups, store them apart from the main infrastructure, and rehearse a restore, so recovery time is a known number rather than a hopeful estimate during an incident.