Even sound procedures show room for improvement when exercised fully and realistically. Guidance: build an exercise programme that, over time, proves the strategies and solutions, plans and procedures work; the programme coordinates how capability is built, developed and matured, and sets out the individual plans, people (third-party representatives included), capabilities and resources that serve the organization's strategic aims. Top management sees that programme objectives are set and a competent person put in charge; the programme's reach reflects the organization's size and nature and how functional, complex and mature the plans and capabilities are, so an early programme may stick to checklists, drills and awareness sessions and later add tabletop exercises and full real-time simulations; it adapts to organizational change and past results, significant change triggering extra exercises to try the revised arrangements; it takes account of every party's role, such as outside providers, suppliers and any others expected to help recovery, who can be invited in and whose exercises the organization can join; and to deliver on time and efficiently it covers needs analysis, top management sign-off, clear objectives, the reach, number, kinds, length, place and timetable of exercises, suitable people to keep it current, resources and budget, and handling of confidentiality, information protection, health and safety and similar matters. Once running, the programme lets the organization exercise the procedures on every operational side, technical, logistical, administrative, procedural and otherwise; everyone with duties under them, outside organizations' representatives included; the continuity arrangements and infrastructure, command centres and work areas included; the recovery of technology and telecommunications, with staff readiness and relocation; and the response teams' handling of impacts from supply chain disruption. The organization monitors and assesses how the programme is carried out against its objectives and reviews it for improvements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.