The organization may hold full-scale drills coordinated with first responders to simulate a real event closely, but only after the plan is validated and external tabletop exercises are done. A drill should be realistic and cover every part of the response, including command, equipment and timely communication; team members, including security, should know their roles beforehand. Drills let external responders train at the site, may use scripted role players as assailant or casualties and tactical teams searching set areas, and should plan for people needing help such as children, older people and those with disabilities or limited mobility. The organization should choose timing carefully and notify employees, volunteers, neighbors, the community and other stakeholders well ahead, tell concealed-carry permit holders to keep firearms away, confine communications to participants, post signs so no one wanders in, test mass notification at the start, and simulate primary and alternate staging locations. The main focus once police take control is accounting for and caring for people on site; the exercise may extend to transport, hospitals and other agencies, with continuity and restart of critical processes a secondary focus. Participants should hold an immediate after-action review, and the workforce should be told in advance that it is an exercise, since drills can raise legal issues.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.