The FI should conduct a threat and vulnerability risk assessment of its data centres covering physical and environmental threats (such as flooding, fire, natural disasters, terrorism, power surge and interference) and the political and economic climate of the location, reviewed on significant threat or environment change; provide redundancy for power, network connectivity and cooling, electrical and mechanical systems, considering diverse network paths, UPS and generators with fuel, and redundant cooling for temperature and humidity; implement fire detection and suppression; geographically separate the DR data centre from the primary; monitor physical security and environmental controls 24 by 7 with tested escalation and response plans; and enforce physical access controls: need-to-have staff access revoked promptly, approved and escorted visitors, secured and monitored access points, restricted and monitored rack access, controlled keys and access devices replaced when lost, and separation of delivery and common areas from sensitive areas.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.