All critical USB IT systems must be backed up five days a week. Backup and recovery must be located off-site and tested by the service provider at a minimum every six months.