IM/BCP/DR ... and of course Controls
As the initial set of controls is driven by the BIA, it defines controls used during IM/BCP/DR….
But as not all controls may be defines (due to undetected/accepted risks), revisions may be required.
Here is how things happen…..
Oh.. Did you realize BCP is a corrective control and DR is a restorative control?