an adequate management structure is in place to prepare for, mitigate and respond to a disruptive event using personnel with the necessary authority, experience and competence;
processes, procedures and implementation changes to maintain existing information security controls during an adverse situation;