Guidance for top management to set a business continuity policy framed around the organization's aims and obligations. The policy is a short, high-level statement of what top management intends for the BCMS and where it is heading; it suits the organization's purpose given its size, nature, complexity, culture, dependencies and operating setting; it gives a basis for setting objectives; it commits plainly to meeting applicable requirements, legal and regulatory duties among them; and it commits to improving the BCMS continually. The policy sets out the reach and limits of business continuity, with any limitations and exclusions; the authorities and delegations needed, naming who answers for the BCMS; and the standards, guidelines, regulations or policies the BCMS takes into account or complies with. It can also commit funds, point to linked policies, require that business continuity be put in place and commit to exercising and maintaining it; where other management systems exist, the BCMS policy can be merged with theirs. Arrangements are made to approve the policy, keep documented information on it and review it on a cycle (yearly, for instance) and whenever significant change inside or outside occurs, such as new top management or new law.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.