The managing agent can respond to and recover from a cyber incident. Foundational: incident management procedures, communication plans included, are part of business continuity plans that are available offline and tested regularly; backup and restore of critical systems is tested regularly. Intermediate: communication plans for reacting promptly to alerts outside working hours are clear, and are reviewed and refreshed at regular intervals; post-incident analysis and lessons learned are carried out so that controls can be strengthened. Established: it has been tested that forensic examination of logs and machine images, by internal staff or outside specialists, can begin at once; playbooks and capability exist to act on alerts or suspected events, for example quarantining, powering off or locking machines, suspending accounts or limiting network access according to data sensitivity, or keeping individual business critical systems running. Advanced: outside partners test response and recovery from time to time (for example red team, FS-ISAC or STAR-FS), core system recovery plans are tested regularly and playbooks exist for rebuilding the whole environment from scratch.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.