To show its commitment to managing risk and resilience, the organization determines and records, as part of the context review: which of its activities, functions, services and products are critical, which partnerships, supply chain links and stakeholders matter most, and the potential impact of a disruptive incident within one or more supply chains; the end-to-end supply chain components for its goods or services, showing how they are configured and linked to deliver critical goods or services; how the resilience management policy relates to its objectives and other policies; why risk and resilience management is needed; who holds authority and responsibility for it; its risk appetite or aversion; the resources available to those who hold that authority; its commitment to review and revise the resilience management policy periodically; and continual improvement.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.