Management identifies and trains the personnel with critical information security roles during a disaster, defines the security needs of backup sites and alternate communication networks and keeps their technologies and plans current, maintains policies covering information security incident response and resilience, includes explicit security incident response steps in the business continuity plan because security events can trigger it, and tests security event scenarios as part of resilience testing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.