The policy must require a formal plan for responding to IAC cyber incidents that runs from preparation through detection and analysis to containment, eradication and recovery; the plan is risk-assessed for disclosure and modification, classified and protected, approved by authorised personnel, shows how the capability fits the organisation, reflects the organisation's mission, its critical infrastructure role, its size and structure and its essential functions, defines a reportable incident, includes a communications plan, names decision-makers and an escalation route and sets out the resources and management support to sustain the capability. A cyber contingency response plan must also exist for disaster scenarios to keep essential functions at the required level: approved, distributed to contingency personnel and stakeholders, updated for system and organisational change with changes communicated, risk-assessed, classified and protected, coordinated with incident handling, identifying essential functions and their contingency requirements, naming roles and contacts, defining recovery objectives, restoration priorities and metrics, and restoring fully without weakening the original safeguards. At the Enhanced Profile incident response is supported 24 hours a day (a TSA requirement) and contingency development is coordinated with the owners of related plans; at the Extended Profile capacity planning confirms processing, telecommunications and environmental support capacity during contingency operations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.