Approved policy, standards and procedures govern how backup and recovery is planned, implemented, tested and set as strategy; backup and recovery serve point-in-time recovery as well as disaster recovery; standards set out requirements for data residency and isolation and security requirements aligned with the classifications in the catalog; architectural guidance supports design of backup and recovery; and plans reflect the standards and guidance. Plans are tested at once and at intervals, set retention, capacity and disposal of backups, cover configuration, environment variables, scripts, source code, model training data and encryption keys, meet air-gap expectations through network isolation, logical separation, physical redundancy, immutable storage and encryption with evidence from the provider, and are driven by recovery point and recovery time objectives by system criticality.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.