What it asks for. Article 12 requires financial entities to define backup policies and procedures specifying scope and frequency, and restoration and recovery procedures and methods. Backup systems must be physically and logically segregated from the source ICT systems and restoration must be tested periodically.
In practice. Backups are scheduled according to criticality, stored securely and separated from production, and restorations are tested and documented. Recovery methods account for data integrity, and redundant ICT capacity is maintained where appropriate. Evidence includes backup policies, job reports, segregation design and restoration test records.
Common gaps. Segregation is often logical in name only, with backups reachable from the same compromised domain. Restore tests may cover single files rather than full systems.