The institution sets availability objectives from customer service levels and regulatory requirements, regularly reviews system, network and data architecture to remove design weaknesses and any single point of failure, with dependencies on internal and external parties mapped, and reduces or mitigates concentration risk at industry, group and institution level. Systems are designed to optimise resources and reduce bottlenecks with redundancy or fault tolerance for high availability and critical components; hardware and software are adequately provisioned with performance, utilisation and capacity indicators monitored and procedures to respond at thresholds; availability expectations under normal and stressed conditions are communicated with drawer plans for stressed conditions. Network redundancy with multiple paths and load balancing eliminates single points of failure, and a telecommunications diversity assessment covers data centre interconnections, internet connections for critical systems and connections to critical third parties. Hosting options are assessed against business needs, risk appetite and regulation with a threat and vulnerability risk assessment of physical and environmental threats and the political and economic conditions where it sits, reviewed on material change; redundant, geographically separated data centres on different infrastructure providers serve as secondary or disaster recovery sites under an appropriate availability model; environmental and redundancy arrangements for power, telecommunications, water, cooling, fire suppression and climate control eliminate single points of failure where feasible; physical security, upkeep and environmental controls are monitored with tested escalation; and access is strictly controlled from entry to equipment racks.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.