4.2.2. Based on the results of the risk assessment carried out pursuant to point 2.1 and the …

(a)

recovery times;

(b)

assurance that backup copies are complete and accurate, including configuration data and data stored in cloud computing service environment;

(c)

storing backup copies (online or offline) in a safe location or locations, which are not in the same network as the system, and are at sufficient distance to escape any damage from a disaster at the main site;

(d)

appropriate physical and logical access controls to backup copies, in accordance with the asset classification level;

(e)

restoring data from backup copies;

(f)

retention periods based on business and regulatory requirements.