The FI should have a cyber incident response and management plan to isolate and neutralise threats swiftly and resume services securely, describing communication, coordination and response procedures for plausible scenarios; as part of it, investigate the security or control deficiencies behind a breach and evaluate the full extent of impact; and use threat intelligence and lessons learnt to strengthen controls and improve the plan.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.