[rarestia]

My backups are IPSEC encrypted at rest first, transferred over encrypted protocols, and then encrypted again on Microsoft’s Azure system. Only I have the certificates used to encrypt the first time, and I use 4096 bit keys.

[dayglored]

Sounds about right.

I also have off-site physical backups (encrypted of course) that can be retrieved very quickly compared to even the 100Mbps fibre internet connection. Never underestimate the bandwidth of a station-wagon full of hard drives.

[tacticalogic]

My backups are IPSEC encrypted at rest first

I didn't think you could use IPSEC to encrypt at rest. It's an "on the fly" packet level encryption that secures data on the wire.