The organization should establish IRBC as a defined arrangement: its policy or mandate, its governance under 6.2, its place within BCM and information security management, the roles that own it, and the process by which its objectives, strategies and plans are developed, tested and maintained, so that ICT readiness is a managed capability rather than a set of technical projects.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.