An institution that outsources all or part of its business continuity capability confirms the provider has sufficient knowledgeable staff for on-site support at the recovery site, allocates enough processing time, resources and security controls to serve multiple clients so that normal volumes can be processed on time, discloses access limitations and guarantees or explains the priority of the institution's right to use the site, keeps compatible hardware and software with contractual notice of changes, allows adequate physical and logical security, gives contractual access for at least one full-scale annual test including telecommunications while testing its own plan and reporting results, and protects the confidentiality of the institution's data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.