The organization should test and exercise the protection, resilience and recovery elements of its ICT services to show that services can be protected, maintained or recovered whatever the severity of an incident, that the IRBC arrangements limit business impact, and that the return to normal works. The programme should be progressive, from familiarisation to full tests, cover end-to-end service delivery without exposing the organization to unacceptable risk, align with the BCM scope and objectives, and give each exercise business and technical objectives, testing both component-level and whole-site recovery across hardware, software, infrastructure, data, services and the part suppliers play. Planning should limit risk (backups taken, isolated environments, quiet hours, users informed), and each exercise should have terms of reference (its objectives and scope; the assumptions, constraints and risks; how success is judged; the resources, roles and timeline; how data is captured and logged; and the debrief and follow-up), a command structure, observers and an issues log, with findings reviewed promptly and actions assigned.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.