The ICT response and recovery documentation should be flexible, feasible, relevant and easy to read, and should set the overall framework within which the individual recovery plans sit: the strategy, the critical services with their RTO and RPO, the recovery timelines and the recovery teams and their responsibilities. Plans should be usable by competent staff during an incident and cover objectives, scope (service criticality, technology, organization and documentation), availability and information security requirements, technology recovery procedures, backup and restoration, handling of backlogs, and further instructions such as hotlines, with an appendix listing the systems, hardware, software, network infrastructure and principal ICT suppliers.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.