What it asks for. This control requires organisations to establish data recovery practices that can restore in scope assets to a trusted state after an incident. It covers backup scope, automation, protection of backup data and regular recovery testing.
In practice. A good approach defines what must be backed up and how often, automates backups and keeps at least one copy isolated from the production environment, for example offline or immutable, to resist ransomware. Backup data is encrypted and access to it is restricted. Recovery is tested on a schedule, including full system restores, and results are recorded. Evidence includes the recovery process, backup job reports, isolation configuration and restore test records.
Common gaps. The most common gap is untested recovery: backups exist but restores fail or take far longer than the business can tolerate. Backup systems that share credentials with production are often destroyed along with it.