Agencies should also put the following into their IRP: clear definitions of the incident types likely to arise; the expected response for each incident type; the authority within the agency responsible for responding to incidents; the criteria under which that authority would start or request formal police investigations of an incident; the other authorities or agencies to be informed whenever an investigation takes place; and the system contingency measures, or a reference to where they are documented if held separately.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.