Establish what disruption costs over time and what could cause it, in one process with two connected outputs. The impact analysis settles the impact types and criteria for this organization, the activities that support products and services, how impact grows over time, the point beyond which failure to resume is unacceptable, prioritized resumption time frames at a stated minimum capacity, the prioritized activities and their resources, dependencies and interdependencies. The risk assessment then judges the likelihood and impact of the events that could disrupt those prioritized activities. The process is refreshed whenever the organization or its operating context changes significantly, and its outcomes scope the strategy process.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.