Management chooses backup and replication methods by the risk and criticality of systems and data and maintains policies, standards and procedures for backup methodologies and responsibilities, inventories of backup media with storage locations and access controls, documented periodic physical reviews of backup material, verification of adherence to schedules, regular readability tests of backup copies, the capability to restore to a previous trusted state, off-site backups of configurations and data on separate systems or media, virtual machine versioning, replication and life cycle policies, encryption and access controls over backup and replicated data, proper sanitisation and disposal, and validation that third-party and cloud providers perform the same processes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.