A financial services company is running a mission-critical payment processing workload in Azure. Their security architect is conducting a Well-Architected Framework (WAF) review and discovers that although Microsoft Defender for Cloud plans are enabled, security alerts are only reviewed manually during business hours, and no formal recovery objective has been defined for the payment database. Executives want the WAF review to recommend the change that most improves the workload's ability to withstand and recover from a destructive attack while remaining aligned with WAF security and reliability pillars. Which recommendation should the architect prioritize?