The FI must put in place a framework and process to identify its critical systems. The FAQs add that the framework and the list of critical systems should be documented and kept for supervisory request (not filed with MAS), and that every FI must have the framework even if the assessment finds no critical system.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.