A known-good backup is a copy of systems, configurations, or data that has been verified as clean, intact, and usable before recovery begins. The key idea is trust: defenders do not simply assume a backup is safe; they test it, validate it, and keep it separate from active systems so it is less likely to be tampered with by malware or an intruder.
This matters because attackers often target backups to block recovery or to make a restore reintroduce malicious code. In ransomware cases, compromised backup repositories can leave an organization unable to rebuild safely. In critical infrastructure and OT environments, a known-good backup may include controller logic, firmware, and configuration state, not just files. Used properly, it gives defenders a clean recovery path after isolation, helping them restore service without bringing the attack back with them.