Establish a contingency planning policy and programme per NIST SP 800-34 Rev 1 Section 3.1 (Develop the Contingency Planning Policy Statement). Policy must define (a) scope and applicability across federal information systems + supporting infrastructure + dependencies, (b) roles and responsibilities aligned with NIST RMF (Authorising Official + System Owner + Information System Security Officer + Information System Contingency Plan Coordinator + Business Continuity Coordinator + Disaster Recovery Coordinator), (c) resource requirements + training requirements + exercise and testing schedules + plan maintenance schedule, (d) integration with other contingency-related plans per NIST SP 800-34 Rev 1 Section 2.2 covering Continuity of Operations Plan (COOP) + Business Continuity Plan (BCP) + Business Recovery Plan (BRP) + Incident Response Plan (IRP) + Disaster Recovery Plan (DRP) + Crisis Communications Plan + Information System Contingency Plan (ISCP) + Cyber Incident Response Plan (CIRP) + Occupant Emergency Plan (OEP). Coordinate authority + scope + activation criteria + handoffs between plans to avoid conflicts during real events. Policy approval by senior management + annual review + revision after significant change.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.