Recovery exercises and tests are formally implemented at a frequency that suits the organisation, with realistic objectives and specific roles and responsibilities, using a combination of exercises and tests (a real test such as disconnecting a critical system to confirm graceful failover is worth its disruption), tabletop scenarios in which one or more members from every team play the adversary, and playbooks built from newly reported events; results are recorded to inform cybersecurity activities, a comprehensive post-exercise debrief analyses what worked and what did not, confirms or refutes planning assumptions, and every concern or deficiency is tracked and remediated.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.