The organization should determine the recovery capabilities ICT currently has for each critical service: the backup and restoration arrangements and their tested recovery point, the alternative facilities, systems and network paths available, the time ICT can realistically recover each service in, and the people and suppliers those capabilities rely on, distinguishing what is proven by test from what is assumed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.