Risk from disruption, in the field of ICT and information security, is primarily an availability risk: an adverse situation removes ICT services from the business activities that depend on them. Such risks have very low likelihood and very high consequence, so business continuity exists to minimise the consequences when they occur, because the likelihood can rarely be eliminated. Prioritised activities and their ICT dependencies and critical time frames come from the business impact analysis; the risk scenarios come from threats and sources that include environmental events, hardware, software, power and HVAC failures, unintentional human error such as change management mistakes or wrongly configured backup, intentional human action such as hacking, malware and sabotage, societal events such as pandemics and strikes, cyberattacks such as DoS and DDoS, and ICT supply chain events such as losing the communication link with a provider, an outage at a cloud service provider, or unclear security requirements in contracts for externally provided ICT. The resulting scenarios, loss of critical hardware and software, of a critical ICT service, of facilities, of a supplier's service, or of key personnel, should be considered in ICT business continuity planning where relevant, overall strategies determined and plans developed and tested to establish the residual risk handed back to risk management; risk assessment and treatment mitigate risk but never remove the need for IRBC, because something unforeseen can always happen.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.