For hazards, threats, risks and the resilience policy, the organization keeps procedures for: documenting, recording and communicating changes to documents, plans, procedures, the system and the results of assessments and reviews; internal communication between levels and functions; external communication with supply chain partners and stakeholders; receiving, documenting and answering communications from outside stakeholders; taking any national or regional alert scheme for risks and threats, or its equivalent, into plans and day-to-day operations; passing on critical information and knowledge along the chain; alerting stakeholders and partners to the potential impact of an actual or impending disruptive incident; making crisis communication means available during a disruption; structured communication among emergency responders; interoperability of multiple responding organizations and staff; recording vital incident information, actions and decisions; and keeping communication facilities working. Guided by life safety, the organization decides its communication priorities, consults partners and stakeholders on what to tell external parties about significant risk, and documents that decision; if it decides to communicate, it sets up methods for external communication, alerts and warnings, including through the media. Communications are tested regularly. Annex B adds relationships with public authorities, audience segmentation, pre-drafted message templates, fast distribution channels and one trained principal media spokesperson with alternates.
This control maps to 3 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 3 it maps to, and the evidence behind each claim, over MCP and REST.