The recovery plan records the approved means of conducting recovery and typically covers: relevant service, operational and organisational level agreements including pre-arranged external support; the two or more managers who may activate the plan; the recovery team members who have reviewed and exercised it; specific recovery details and procedures with diagrams, including alternate processing such as backup servers or a failover site; out-of-band communications that avoid production systems an adversary may monitor; notification and escalation procedures including legal, public relations and human resources involvement; off-site or offline storage arrangements, critical against ransomware; approved workarounds if the recovery time objective cannot be met; facility recovery details; and the infrastructure, hardware and software (identity management, recovery network, messaging, staging system to validate restored data) that intermediate the recovery.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.