Restoring service quickly after a security incident can reduce the chance of investigating its cause, so the organisation balances the service management instinct to restore at once against the security instinct to preserve evidence and perhaps observe the incident in progress. Care should be taken that every requirement on managing security incidents is met, including controls for collecting, retaining and providing evidence for disciplinary or legal purposes. Evidence collection can mean an affected service is not restored within agreed targets; ISO/IEC 20000-1 requires prioritisation that takes the incident's information security risk into account, and the resolution priority should weigh the importance of collecting evidence that restoration would destroy, allowing extra time where needed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.