All critical USB IT systems must be backed up five (5) days a week. Backup and recovery must be located off-site and tested by the service provider at a minimum every six (6) months.