What it asks for. The organisation must back up user-level information, system-level information and system documentation, including security and privacy documentation, at defined frequencies consistent with recovery objectives, and protect the confidentiality, integrity and availability of the backups.
In practice. Doing this well means backups that match agreed recovery point objectives, at least one copy that is immutable or offline, encryption of backup data and separate credentials for backup administration. Regular restore tests prove the backups work. Auditors expect backup policies, job success reports, restore test records and evidence of protection against tampering. CIS Control 11 describes the same expectations.
Common gaps. The most damaging gap is backups reachable with the same administrator credentials attackers steal, so ransomware destroys them too. Restore testing is often limited to single files rather than full systems.