The FI should develop and implement mitigation and control measures consistent with the criticality of information assets and its risk tolerance, reviewing and updating the control approach as threats and the risk profile change; assess whether residual risk has been reduced to an acceptable level, with defined criteria and approving authorities for risk acceptance commensurate with its tolerance; and take insurance cover for insurable technology risks to reduce financial impact such as recovery and restitution costs.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.