ICT services becoming unavailable during an adverse situation is one of the information security risks the risk management process covers, and it is the part of that process that bears on business continuity and ICT readiness; such risks combine very low likelihood with very high impact. Treatment of these risks should take in business continuity controls, which modify and lower the risk and lessen the effect on the business through the introduction of IRBC, and the risk management process should settle the extent and capability of IRBC so that it is consistent with the business's risk appetite and with the business impact analysis. Risk management and risk status reporting help the business take a strategic, long-term view of the risk and of any decision to accept it. IRBC is how the organization actually implements the ICT readiness for business continuity control of ISO/IEC 27002:2022, 5.30; ISO/IEC 27005 describes the wider information security risk management process. The Foreword records this sub-clause as new technical content in the second edition.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.