The implementation boundary
Inventory application files, configuration, uploaded media, database and any required encryption keys. A content export is not necessarily a full backup. Follow the application’s consistency procedure; copying an active database file without understanding its storage mode can produce an unusable snapshot.
Verification that matters
Restore into an isolated environment, disable real outgoing email and verify a sample account, recent records and media. Keep backups outside the public web directory and restrict access. Record the restore steps, retention period and owner. Verify this procedure before applying migrations to production.
Official documentation and further reading
This is an overview based on official product information, not a hands-on performance test or security certification.