Strategy options should cover protection and resilience, recovery and restoration, and third-party arrangements, component by component. Skills and knowledge: documentation, multi-skilling, separating core skills across people and places, knowledge retention. Facilities: alternative sites, working from home, an established workforce elsewhere, moving physical assets. Technology: ICT services available before the business activities that depend on them resume, within the RTOs, with attention to the number and distance of sites, remote access, power and cooling, staffed or unstaffed sites, telecom connectivity and redundant routing, automation, obsolescence and links to outsourced providers. Data: continuity solutions that meet each activity's RPO and keep critical data available, intact and confidential, with the storage media, backup and restore methods, storage and transport locations and retrieval times decided. Processes: the prevention, detection, response and recovery processes and what they need to work. Suppliers: external dependencies identified and documented, with critical equipment and services assured within set times (for example duplicate equipment at another site, emergency supply and rapid repair arrangements, dual utilities, standby power, alternative suppliers), and ICT continuity requirements written into contracts whose schedules state each party's obligations, service levels, major incident response, cost sharing, exercise frequency and corrective actions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.