Management must make available what the management system cannot do without (people and their skills, equipment, infrastructure, technology, information, intelligence and money); set, record and communicate roles, duties and authority; and name one or more management representatives who set up, communicate, run and keep the system and report on how it performs to top management. The organization must form an OR management team with authority over readiness for, response to and recovery from incidents; build the logistics capability and procedures to find, obtain, store, hand out, maintain, test and account for services, people, resources, materials and facilities; set resource management objectives, with timescales, for response times, people, equipment, training, facilities, funding, insurance, liability, expertise and materials; set procedures for helping stakeholders, communicating, forming alliances and mutual aid; and set financial and administrative procedures that speed up money decisions, within the authority levels already fixed, before, during and after an incident.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.