The FI should have a system and data backup strategy and plan for regular backups; a policy for the backup data life cycle (frequency, retention, storage mechanisms, secure destruction); periodic restoration tests to validate procedures; and protection of backups against unauthorised access and modification, with confidential data secured (for example encrypted) and media stored offline or offsite.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.