What it asks for. This control expects backup copies of information, software and systems to be maintained and regularly tested in accordance with an agreed topic-specific backup policy. Its purpose is to enable recovery from loss of data or systems.
In practice. Good practice means backups defined by business requirements for recovery, protected from the same threats as production, including ransomware, through isolation or immutability, and restored regularly to prove they work. Responsibility for backup of SaaS data is clarified with suppliers. Auditors expect the backup policy, job status records, restore test results and protection of backup systems.
Common gaps. Common gaps are backups that have never been restored, backups reachable with the same administrator credentials as production and SaaS data assumed to be backed up by the provider.