Guidance that measuring how well continuity plans, procedures and capabilities work extends to the continuity provisions for outsourced activities and to the continuity of the suppliers and partners that prioritized activities rely on. Example criteria: backup data recent enough to restore activities and resources within their RTOs; premises and equipment needed to continue and recover available at alternative sites; evidence of the competence needed to restore prioritized activities within their RTOs; and proven competence to respond to and manage incidents. After a disruption a review is held, which can look at what the disruption was and what caused it, whether management responded adequately, how well RTOs were met, whether the continuity provisions had readied staff for the incident, what should be improved, how actual harm compared with the harm foreseen in the impact analysis, and what interested parties and responders said.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.