The entity develops action plans under its Article 5 rules for emergencies, natural disasters and any other unexpected event capable of interrupting its services. Each plan states the circumstances it covers, the thresholds that trigger it, the person authorised to approve activation, and the steps to bring services and operations back to a defined level. Plans are tested at least once a year to confirm relevance and to train those responsible, kept up to date, accessible only to those who execute them, and stored in at least two places, one of them outside the building that houses the systems concerned.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.