Working out and acting on risks and opportunities is how the organization gives the BCMS a fair chance of delivering its outcomes, heads off or lessens unwanted effects and keeps improving. Guidance: decide actions on the matters found under 4.1, on what interested parties need and expect under 4.2 and on the legal and regulatory requirements under 4.2.2, weighing the risks and opportunities and how they could affect how well the BCMS works. Such risks can stem from top management not leading or committing, BCMS funding too thin to support an effective response, poorly kept documented information, a shortage of staff with proven competence, a weak management review, or being shut out of new markets that demand business continuity. This clause is about BCMS effectiveness; the risk of disruption to prioritized activities belongs to 8.2.3.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.