Top management should review resilience periodically to make sure it still meets expectations. It should take account of how the context has changed, including: a change of vision, strategy or objectives; major changes to structure or business model, such as mergers, acquisitions or divestments; entry into new markets or territories; new products and services; significant changes in staff, top management included; how effective improvements made since the last review have been; feedback on how effective resilience is; and changes in the risks the organization must deal with. Top management should also set the results of the resilience evaluation alongside those of related review processes (for example internal audit, debriefs after incidents, strategic planning, near misses and regulatory compliance), and should confirm that monitoring arrangements are suitable and help issues to be spotted and dealt with before they do serious harm or before an opportunity slips away.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.