What it asks for. Implement information processing facilities with enough redundancy to meet availability requirements.
In practice. Availability requirements are agreed with the business for important services, and architectures are designed to meet them, for example by duplicating components, using multiple availability zones or sites, and removing single points of failure in networks, storage and power. Failover is tested regularly and the results are recorded. Dependencies on single suppliers or regions are recognised and assessed. Auditors look for documented availability requirements, architecture diagrams showing redundancy and records of failover tests.
Common gaps. Redundancy is designed in but never tested, and failover breaks when it is finally needed. Hidden single points of failure, such as a shared identity provider, DNS service or configuration store, often undermine otherwise redundant designs.