Guidance that each business continuity plan states its purpose, reach and aims in terms its teams understand; points clearly to the other procedures or documents it relies on and says how to get hold of them; and sets out how and when it is invoked, how it is carried out, what must be communicated and how, how it depends on and interacts with others inside and outside, the resources it needs, what must be reported, and how information flows and is recorded. Each plan gives: roles, duties and authority (those of the people and teams using it, and guidance and criteria on who may invoke it and in what circumstances, possibly with defined stages of escalation); invocation (how the organization's response to disruption is set in motion and, within each procedure, its criteria and steps for invocation, allowing for working and non-working hours, with suitable assembly points); operating detail (the actions and tasks to be carried out, including how prioritized activities will continue or restart within preset timescales, the resources needed, how incident information, actions and decisions will be logged, and supporting information for coordination and communication: contact details of team members and others with roles, held with regard to data protection law and with proof of compliance, and contact and call-out details of relevant agencies, organizations and resources); and stand-down (how the response is wound down once the incident is over and the instructions to follow). The organization makes sure the plans, like any documented information, can be used and reached when and where they are needed; so that a disruption does not also cripple the plans, precautions such as dividing teams and recovering ICT at more than one site may be needed, and where complete separation cannot be had the limits are set and agreed with top management by distance, minimum headcount or severity and may hinge on the government response to severe or widespread disruption.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.