The institution assesses its inherent risk, the threat exposure arising from the types, volumes, values and complexity of its business in cyberspace, by rating each assessment criterion of the inherent risk matrix low, medium or high with supplementary sizing, volume, amount or judgement: technologies and connection types (ISP and third-party connections, unsecured connections, wireless, non-corporate devices, wholesale dedicated connections, in-house and vendor applications, user-developed tools, end-of-life systems, unsupported open-source software, network devices, service providers, cloud); delivery channels (internet, mobile, social media, internet-connected ATMs); products and technology services (cards, prepaid, person-to-person payments, wire transfers, remittances, treasury, trust, correspondent banking, merchant acquiring, securities trading, hosting IT for others); business size and organisational characteristics (branches, revenue, assets, staff, changes in IT and security staffing, privileged users, cybersecurity staff); and tracked records of attacks over the last 12 months by volume and type.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.