A comprehensive recovery communications plan is developed and woven through every recovery policy, plan, process and procedure: its goals, objectives and scope are defined; stakeholders are identified internally (IT teams, incident response, senior management, business owners, legal, human resources, privacy, the board) and externally (response teams, partners, customers, regulators, credit agencies, law enforcement, media, analysts, insurers) with current points of contact; it is agreed in advance who reports what to whom; guidelines set what may and should be shared with each constituent so that updates carry actionable, accurate information; and alternate secure channels are ready and practised for when email or the network cannot be trusted. Communication continues across the tactical and strategic phases.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.