Principle 5 expects a bank to manage the dependencies, on third parties and on group entities alike, through which critical operations are delivered. Before signing any such arrangement the bank assesses the risk and does due diligence consistent with its operational risk framework, its outsourcing policy and its resilience approach, and confirms that the provider's own resilience is at least on a par with what is needed to protect the bank's critical operations, in normal times and during a disruption.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.