The organisation formally defines and documents the triggers for invoking the recovery plan, who holds the authority to invoke it and how recovery personnel are notified; defines key milestones for intermediate recovery goals and the criteria for ending active recovery; ensures the plan's underlying assumptions, such as the availability of core services, the trustworthiness of directory services and an understood adversary motivation, will not undermine recovery; and adjusts detection and response policies so that recovery does not hinder response, for example by alerting the adversary or destroying forensic evidence.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.