The institution establishes a written incident response plan designed to promptly respond to and recover from any security event materially affecting the confidentiality, integrity or availability of customer information in its control, addressing the goals of the plan, the internal processes for responding to a security event, clear roles, responsibilities and levels of decision-making authority, external and internal communications and information sharing, the requirements for remediating identified weaknesses in information systems and controls, documentation and reporting of security events and response activities, and the evaluation and revision of the plan after a security event. Not required of institutions holding information on fewer than 5,000 consumers (314.6).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.