The distinction between mirroring and keeping recoverable history is especially useful. I would add a recovery-time objective alongside RPO: a weekly copy may meet the data-loss target but still take days to download and restore. A practical drill is to restore a small service onto a clean machine using only the offsite copy and the documented recovery steps, then time it and check that the application actually works. That also exposes missing encryption keys or credentials that were stored only on the failed machine. Backup-success logs and repository checks are valuable, but neither alone proves that recovery is possible.