US Interagency Sound Practices to Strengthen Operational Resilience 6c: Controls safeguarding the integrity and availability of critical data against destructive malware including ransomware, with secure, immutable, offline storage for recovery

What does 6c require?

Controls protect the integrity and availability of critical data from destructive malware such as ransomware and similar threats, and recovery arrangements can include secure, immutable, off-line storage of critical data.