Sets the supervisory approach to business continuity planning and the sound practices expected: board and senior management oversight (policy, process and responsibility, monitoring and reporting), business impact analysis and recovery strategy, the development of the plan (crisis management process, business resumption, technology recovery, continuity models, vital record management, public relations and communication, other mitigating measures), alternate sites for business and technology recovery including vendor-provided sites, and implementation through testing and rehearsal and periodic maintenance; it is read with OR-2. Classification: a non-statutory guideline issued as a guidance note; version V.2, 31.05.2022; applies to all AIs.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.