The ICT business continuity policy under DORA Article 11(1) must describe its objectives (linking ICT and overall continuity and using the BIA), scope with limitations and exclusions, the timeframe covered and the criteria for activating and deactivating continuity, response and recovery and crisis communication plans. It must cover governance and organisation with roles, escalation and resources; alignment with overall business continuity plans on failure scenarios (including those of Article 26(2)) and on recovery time and recovery point objectives for critical or important functions; plans for severe disruptions with risk-based prioritisation; development, testing and review of response and recovery plans; review of effectiveness; and alignment with the communication policy and crisis communication of DORA. CCPs must set a maximum recovery time of two hours for critical functions, complete end of day processing in all circumstances, address external interdependencies and keep a secondary processing site with a distinct geographic risk profile and a secondary business site; CSDs must set a recovery time objective of no more than two hours; trading venues must be able to resume trading within or close to two hours with data loss close to zero.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.