US Interagency Sound Practices to Strengthen Operational...

What does 6a require?

Information systems behind core business lines and critical operations, including parts that depend on third parties, are covered by programmes for risk identification, protection, detection, response and recovery that are tested regularly, carry appropriate situational awareness and give management relevant information promptly.

Other controls in Section 6 Secure and resilient information system management (practices a to e) – US Interagency Sound Practices to Strengthen Operational Resilience

6b Routinely apply and evaluate processes and controls protecting the confidentiality, integrity, availability and overall security of data and information systems
6c Controls safeguarding the integrity and availability of critical data against destructive malware including ransomware, with secure, immutable, offline storage for recovery
6d Regular review of information systems and controls against industry standards and best practice, updated for evolving cyber threats and new technologies
6e Use of a standardised cybersecurity preparedness assessment tool aligned with industry standards, such as those listed in Appendix A

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All US Interagency Sound Practices to Strengthen Operational Resilience controls