The organization must keep procedures that identify the disruptive incidents that could affect it, its activities, functions and services, its stakeholders and the environment, recording how it will prevent them, get ready for them and respond to them; and it must get ready for and respond to incidents that do occur so as to prevent or limit their consequences, with regard to protecting life and assets, stopping the incident growing, keeping the disruption short, restoring critical continuity, getting normal operations back and protecting reputation. The procedures should cover: hazards on site and off; the likely kind and size of incident; ways of mitigating and of responding to emergencies; protecting the environment; command and control, emergency operations centres and alternate worksites included; who may declare an emergency and take financial decisions; communication plans; medical care; keeping casualties and damage to a minimum; securing vital information, systems, facilities and people; what to do for each kind of incident; evaluation after the event; periodic testing; training responders; lists of key contacts; evacuation routes and assembly points; dependencies on critical infrastructure; mutual aid; and recovering each critical activity within its recovery time objective, with the resources needed. The procedures must be reviewed and revised, above all after incidents that could have escalated; the people who carry them out must be competent, with records kept; and the information must be recorded and refreshed on a schedule or when things change.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.