The company has a formal policy defining how often data is backed up and how backups are protected
Sekit's Backup policy, one of the topic-specific policies A.5.1 expects, defines what data is backed up, how often, how long copies are kept, and how one copy resists tampering or ransomware.
A.8.13 asks for backups that are taken and proven restorable. RCF-0238 is the policy leg: it sets scope, frequency, retention, and the restore-test cadence that the technical controls then execute.