The organization identifies and assesses internal and external risks to every manufacturing process and every item of infrastructure equipment needed to keep up production output, and it sets contingency plans in line with the risk and with the impact on the customer. The plans keep supply going through failure of key equipment; disruption to products, processes and services obtained from outside; natural disasters that recur; fire; loss of utilities; shortage of labour; and disruption of infrastructure. They add a process for telling customers and other interested parties how far, and for how long, any situation affecting customer operations will reach. The plans are tested from time to time, reviewed at least once a year by a cross-functional team that includes top management, and documented with a revision history that names who authorized them. They include steps for confirming that product still meets the customer's specification when production restarts after an emergency stop in which the normal shutdown process was not followed. As revised: SI 3 (October 2017, revised July 2021), with SI 17 (October 2019) merged in: pandemics and cyber-attacks on IT systems join item c), whose list becomes open-ended; item e) describes cybersecurity testing (simulating an attack, monitoring threats, identifying dependencies, prioritizing vulnerabilities, scaled to the risk of disrupting the customer, and allowed to be subcontracted); and item h) adds employee training and awareness.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.