The FI should set recovery time and recovery point objectives aligned to its business resumption and recovery priorities; maintain a disaster recovery plan with procedures for various disaster scenarios and the roles of recovery personnel, reviewed at least annually and on material change; follow the tested, approved plan during recovery, using untested measures only in exceptional cases after a risk assessment, adequate controls and senior management approval; and periodically operate from its recovery or alternate site to confirm it can support business for an extended period.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.