The organization keeps procedures to manage disruptive incidents that could affect it, its activities, functions, services, supply chain, stakeholders and environment, documenting how it will prevent, protect against, prepare for, mitigate, respond to and recover from them, and prepares for and responds to actual incidents to prevent them, lower their likelihood or soften their consequences. In designing these procedures it considers: life safety; protecting assets; stopping further escalation; shortening the disruption; restoring critical operational continuity; returning to normal operations with a review of improvements; and protecting its reputation and public image, with attention to the press and to relations with stakeholders. It reviews and, if needed, revises the procedures periodically and especially after exercises, or after accidents or incidents that might grow into an emergency, a crisis or a disaster. People carrying out prevention, protection, preparedness, mitigation, response and recovery on its behalf are competent through education, training or experience, with records kept, and the information is documented and updated regularly or when it changes. Annex B adds that treatment options include avoidance, prevention, spreading, reduction, sharing and acceptance.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.