Recovery plans are built from a range of disruption scenarios proportionate to the IT environment, aligned to the established RTOs and RPOs, detailed enough to prevent unauthorised or inappropriate activity, and approved by management; they are reviewed and updated regularly for changes in the environment, dependencies and related policies, and staff using end-user computing make alternative arrangements or have those resources included. Plans are tested regularly with senior management, business units and the third parties that operate or deliver services, the institution operates fully from recovery arrangements where possible to build confidence, and on activation recovery follows rehearsed and approved procedures with any necessary deviation risk-assessed and approved by management.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.