ICT response and recovery plans under DORA Article 11(3) must use the BIA; set activation and deactivation conditions and exceptions; describe the actions to keep at least systems supporting critical or important functions available, intact, continuous and recoverable; meet recovery objectives; be documented, accessible in an emergency, with clear roles; provide short and long term recovery including partial recovery; and set objectives and success criteria. They must identify scenarios from current threat information and lessons learned, at least cyber-attacks and switchovers, unacceptable degradation or failure of a critical function including provider insolvency or failure, loss of premises or data centres, failure of ICT assets or communications, unavailability of critical staff, climate, natural disaster, pandemic and physical attack events, insider attacks, political and social instability including in provider and data locations, and widespread power outages. Plans must consider alternatives where primary recovery is not feasible in the short term and include continuity measures for failure of providers of services supporting critical or important functions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.