And to add to that, offline backups that go back 90+ days. Ransomware gangs frequently use time bombs to deploy their encryption after sitting within a system for a month or two. If you get hit by one of those gangs and only keep backups for 45 days, you're screwed, because your backup is still infected.