The CIRP must secure backed-up data, store backups separately from the system, and have procedures ensuring backup data is free of known malicious code when made and when tested for restoral.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.