For each critical ICT service the organization should compare its current readiness arrangements with the business continuity requirements, document the gaps, and tell top management about them and the risks they create; closing them may need more staff, facilities, technology, applications, databases, money or outside services. Top management should approve the ICT service definitions, the critical service list and the identified risks, and the options for closing the gaps are explored by determining IRBC strategies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.