A working incident procedure covers reporting, contact with interested parties, withdrawal and recall, so that failing product can be found and taken out of the supply chain; a named person informs customers, consumers and authorities; the system is reviewed and tested at least yearly with records; every incident is logged and rated for severity and consumer risk and acted on. Top management also has procedures, documented and maintained, for emergencies relevant to the site's role, such as natural disasters, public health emergencies or loss of water, power or refrigeration.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.