The organization must set and keep recorded, measurable objectives and targets for avoiding, preventing, deterring, mitigating, responding to and recovering from disruptive incidents, including what it expects of critical outside relationships such as suppliers, in line with the policy's commitments to preventing and mitigating risk, to resilience, to financial, operational and business continuity (continuity of the workforce included), to compliance and to continual improvement, and having regard to legal requirements, significant risks, the technology options available, business needs and the views of stakeholders. It must run strategic programmes to reach them that assign responsibility and resources, take account of activities, legal and contractual duties, stakeholder needs, mutual aid and the environment, and set how and by when; and it must run programmes for prevention and deterrence, mitigation, emergency response, continuity and recovery, checking whether the measures themselves create new risks.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.