(1)
Risk management should form part of normal business operations.
(2)
Agencies should incorporate emergency response and recovery planning into their business continuity arrangements.
(3)
National agency plans should—
describe national-level responsibilities; and
support locally managed events.