Not always. Sometimes backups also get infected or are not sufficient to get back to work quickly. How much data do you lose? What is the recovery time? How bad is it if the whole company can't work for 24 hours... or maybe longer? Dealing with retention is also important. If you were hacked last week and the consequences only become visible today, do you have enough backups/retention to look back into the past? An employee who left the company last year and deleted or compromised data is also a hack. Can you go back a year with your backup? Finally, you also need to have a plan if things go wrong and see how quickly you can get back on your feet. A continuity plan helps with that.