The problem you describe in your editorial describes every company I have ever worked for. Management seldom considers the issue you described. Of course there is another solution to this problem, which a previous company I worked for folllowed, and that was to not keep any backup for more than 14 days (this was the maximum amount of data they could store on their backup system). This way, they never have to restore to an older system. Of course, should they ever get audited or get involved in a lawsuit, heads will roll. I'm glad I don't work there anymore.