Principle 3 expects continuity plans to exist and to be exercised against a spread of severe but plausible scenarios so that the bank can show it can keep critical operations running through disruption. A good plan looks ahead when judging the impact of possible disruptions, and exercises are run and validated against scenarios that include real disruptive events and incidents. The plan names the critical operations and the main internal and external dependencies so that the risk and impact of different disruption scenarios can be judged, and it builds in impact analysis, recovery strategies, a testing programme, training and awareness, communication and crisis management.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.