IRBC strategies should define how the required resilience will be delivered through prevention, detection, response, recovery and restoration. The organization should evaluate the full range of options, weigh the resources needed to implement and sustain them, consider external suppliers for specialist services and skills, keep the strategy flexible enough for different business strategies and markets, and take account of internal constraints: budget, resources, costs and benefits, technology limits, risk appetite and the IRBC capability already in place.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.