Principle 1 expects a bank to run its operational resilience approach through the governance structure it already has, so that the bank can respond, adapt, recover and learn when disruptive events hit critical operations. The board signs off the approach after weighing the bank's risk appetite and the level of disruption it will tolerate for each critical operation. Setting that tolerance means comparing what the bank can actually sustain against a wide set of severe but plausible scenarios, and policy must say what happens when capability falls short of the tolerance the board has set.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.