Management understands its insurance needs and the limits of errors and omissions, general liability and directors' and officers' cover, which often exclude IT operations and cyber, builds an insurance program commensurate with size, complexity and risk after weighing exposure, available cover and cost and the effect of an uninsured loss on the institution and its affiliates, takes professional advice and checks the insurer's financial condition, treats insurance as a complement to controls rather than a substitute, documents gaps such as excluded hardware, software and data reconstruction costs, and assesses the cost of cover before purchase.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.