Guidance to evaluate the outputs of the impact analyses, risk assessments, strategies and solutions, plans and procedures to confirm they remain suitable, adequate and effective, weighing possible changes to the policy, objectives and other parts of the BCMS that exercise results, post-incident reviews or changed circumstances may point to. Evaluation can be by internal or external audit or by self-assessment, and how often and when it happens can be shaped by laws and regulations, the organization's size, activities and legal status, and what interested parties require. It confirms that every product and service, with the activities and resources behind it, has been identified and covered by the continuity solutions; that the policy, solutions and procedures truly reflect the organization's priorities and needs; that staff competence and the organization's continuity capability are fit for purpose and let it manage, control and coordinate its response; that the continuity solutions work, are current and fit for purpose; that the exercise and maintenance programmes have been carried out well; that the solutions and procedures take in the improvements found in incidents and exercises and fall within maintenance programmes; that a continuing training and awareness programme is in place; that the procedures have reached the staff concerned, who understand their roles and duties; that suppliers' and partners' continuity arrangements for what prioritized activities depend on are suitable and sufficient; that the organization adequately meets applicable law, regulation and industry good practice and follows its own policy and objectives; and that change control processes exist and work.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.