Dutyholders have the resources, information, skills and authority to enact the plan and limit impact on essential functions, including prioritised recovery of systems, capacity for protracted incidents lasting weeks, fail-over mechanisms and tested external support. Backups of IT and OT systems meet agreed recovery time and point objectives (a 3-2-1 approach is common), recovery is tested, integrity is checked on completion, and cloud backup is planned.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.