Business-critical information stays available: systems, applications, data and documentation are backed up to a defined schedule that covers frequency, mode (for example mirroring for real-time backup, or DVD-ROM for keeping copies over the long term), type (full or incremental), and the media, automation, verification and secure storage used; storage requirements on site and off site match business needs and the accessibility required; archived and backup data are tested and refreshed periodically; and where third parties maintain or process systems, applications, data or documentation, these are backed up adequately or protected in some other way, with consideration given to getting backups returned from third parties or to escrow.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.