After the ICT continuity plans have been developed and tested, the organization should establish the final minimum business continuity objective, together with the final recovery time and recovery point objectives, as the levels ICT can actually deliver: where testing shows the targets of 8.2 are met, they are confirmed; where they are not, the achievable levels are documented as the Final MBCO, the gap against the business requirement is stated, and the decision to invest in closing it or to accept it goes to top management under clause 13. The scope names the MBCO, RPO and RTO as the business continuity objectives this document serves.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.