To support effective PAP management in line with its policy, objectives and programmes, the organization should define, document and communicate roles, accountabilities, responsibilities and authorities. It should set up cross-discipline, cross-functional teams for planning, implementation and evaluation, each given clear roles, enough authority, sufficient resources (equipment that works and is safe to use among them) and plans and procedures it has practised. Procedures should let financial decisions be made quickly within set authority levels and accounting rules. The designated authority should supply the command and control that lets the designated teams run several response and recovery plans at once: setting each off when required, organising triage, allocating people and resources and directing response operations, including support for business continuity plans and supply chain protocols as senior management directs.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.