The organization should test whether its PAPMS plans, processes and procedures (with stakeholder relationships and dependencies on infrastructure) are appropriate and effective through exercises and other means, designed to disrupt operations as little as possible and to keep risk to people, assets and information to a minimum. Exercises should be held regularly, after a significant event, and after significant changes in mission, structure or the external environment. Each should end with a formal report reviewing appropriateness and efficacy, recording nonconformities and proposing corrective and preventive action, and these reports should go to top management review.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.