Business continuity plans describe how the teams will respond to a disruption and keep activities going within the BCMS scope. Because terms vary and are often swapped, the plans state plainly each team's roles and duties and the purpose, reach and aims of the documented procedures behind them (Table 5 gives example teams, roles and duties, from site emergency response and damage assessment, through incident and crisis management, communication, ICT recovery, finance and administration, human resources, salvage and security, to coordinating business continuity). Taken together the plans cover every part of incident response and are tailored to the teams that will use them, so it helps to involve many people, specialist groups among them, in writing them and to use what exercises and real disruptions have taught; timescales and capacity levels come from the impact analysis and the chosen strategies and solutions. The documented procedures set out the chain of actions incident response involves: responding to the incident and assessing it (establishing what happened and how, which parties and which parts of the organization are or may be hit, estimating how long it may last and what harm it may do, judging whether normal management can cope, and checking against preset thresholds whether it could lead to disruption); dealing with the immediate effects, with due care for the welfare of those affected, team members included, and for the environment, weighing the response options and preventing further loss or damage; checking the assessment against each procedure's invocation criteria; declaring the incident and invoking procedures once the criteria are met; calling out response staff into teams for stabilizing, continuing and recovering; setting up a central base for the incident management team (a command centre); ranking the issues and activities to tackle; controlling and coordinating every procedure invoked; invoking or setting up alternative sites for IT or other infrastructure recovery and for temporary working; following the incident as it unfolds; revising plans as circumstances shift; standing down, stopping actions and returning to normal once lasting capability is back; debriefing and drawing lessons; and making sure the records created during incident management and recovery are properly handled, gathered and kept. So that products and services come back on time, the procedure for resuming each activity meets the RTO of the activity behind the product or service and is dependable enough, which is achieved by owning or controlling the means and resources to carry it out or by contracts, agreements or service-level commitments from third parties.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.