Backing up data is a security must. However, it also have certain level of risks when mishandled. Which of the following is the greatest threat posed by backups?

While a backup could theoretically harbor malware, this is a rare scenario and typically mitigated by the same AV controls applied to primary systems.

An incomplete backup is an operational availability risk that is addressed procedurally through verification checks, and does not directly expose confidential data.

Backup unavailability during disaster recovery is an availability concern, but it does not result in unauthorized data disclosure the way theft of unencrypted media does.

Backups often contain a complete copy of sensitive organizational data. If stored or transported unencrypted, a lost or stolen tape/drive/media gives an attacker full access to all that data with no technical barrier. Encryption is the primary control that renders stolen backup media useless, making its absence the most severe and direct risk to data confidentiality.