Assuming attacks cannot be fully prevented, top executives plan for systems being disrupted and consider, as an option, proactively suspending priority services; check the effectiveness of BCPs, customer and stakeholder response procedures and emergency communications, and set internal criteria and procedures for proactive suspension when cyber risk rises, including for jointly operated and cloud systems; recognise that shorter testing may increase IT failures; and prepare for having to stop using third-party software or services when critical vulnerabilities are found.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.