The organization must keep procedures for: recording and passing on changes to documents, plans, procedures, the system and the results of evaluations; communicating internally between levels and functions; communicating with partners and stakeholders outside; taking in, recording and answering communications from outside; building a national or regional threat advisory scheme into its planning; alerting stakeholders hit or about to be hit by an incident; keeping communications working in a crisis; communicating in a structured way with emergency services; making responding organizations' systems work together; logging key incident information, actions and decisions; and running a communications facility. Putting life safety first and after consulting stakeholders, it must decide whether to tell the outside world about its significant risks and impacts, record that decision and, if the answer is yes, set up ways of communicating externally, issuing alerts and warnings and dealing with the media; its communications systems must be tested regularly.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.