Documented information required by ISO 22301 serves as proof of conformity and of the management system working effectively. A procedure is a settled way of carrying out an activity or process; a documented procedure is one developed and kept on a suitable medium; one document can satisfy several documented-procedure requirements and one requirement can be met across several documents. It covers the organization and its context; legal and regulatory requirements; the BCMS scope with any exclusions; the policy; continuity objectives with the plans for reaching them; competence; the impact analysis and the risk assessment; continuity strategies and solutions; continuity plans and procedures; the exercise programme; monitoring, measurement, analysis and evaluation; internal audit; management review; and nonconformities with corrective actions. Further documented information that can help the BCMS work includes customer contracts and service levels; impact analysis and risk assessment results; how continuity solutions were worked out and chosen; reviews of incident response; the awareness programme; the means of telling staff and parties about the BCMS and incidents, such as newsletters, minutes and hazard alerts; training programmes; the exercise timetable; supplier contracts and service agreements; contractors' and suppliers' continuity policies and plans, with proof that they watch their own suppliers' risks and keep up and carry out their plans; contractors' and suppliers' notification and response procedures; inspection, maintenance and calibration records; post-incident and near-miss reports; and minutes of BCMS reviews.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.