The recovery plans should cover data: which copies are used for restoration, how they are retrieved and restored to the recovery point, how integrity and completeness are verified, how data created after the recovery point is recovered or re-entered, and how data protection and confidentiality are maintained during recovery, consistent with the data strategy of 9.2.5.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.