Keep the BCMS honest about itself. The process takes the documentation set, the exercise results, incident and activation reports, supplier information and the applicable legal and regulatory obligations as input and produces an evaluation of whether the impact analysis, risk assessment, strategies, solutions, plans and procedures remain suitable, adequate and effective; an assessment of the continuity capability of the partners and suppliers that matter; a compliance and conformity evaluation; post-incident and post-activation evaluations; and documentation updates traceable to the findings. It runs at planned intervals, after any incident or activation and after significant change. Its outcome is a system that is corrected by evidence rather than by anniversary.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.