The organization should determine the target recovery point objective (RPO) and recovery time objective (RTO) for each critical ICT service, derived from the business continuity requirements and the dependencies, with the ICT targets set so that the business targets can be met once dependencies and recovery sequences are taken into account, and recorded as the targets the strategies of clause 9 and the plans of clause 10 must achieve, before the final values are confirmed in clause 12 after testing. Annex A compares RTO and RPO to the business objectives for ICT recovery.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.