The information security program includes a risk assessment methodology that evaluates the risks of high-risk activities such as funds transfer, uses periodic reviews of those activities to set standards for separation of duties, physical security and least-privilege logical access, assigns appropriate access levels on the funds transfer application to wire room staff, allows no employee more than one user code unless under dual control, and configures message verification rights to separate the employees who initiate from those who verify and send funds transfer messages.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.