The incident response structure should clearly identify the teams responsible for incident response and for continuing activities, the hierarchy of the teams and their roles and responsibilities; it should be simple and quick to form, with mechanisms ensuring timely communication and reporting of decisions; there is no single structure suited to all organizations, and each should design its own considering its existing management structure, the character, culture, scale, complexity and process infrastructure of the organization, the selected continuity solutions, its business continuity requirements and any unforeseen threats; larger or complex organizations may need separate teams focusing on different aspects of an incident, while in smaller organizations one team can suffice, but the responsibility should never rest on a single person.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.