Beyond reviews and exercises the organisation draws lessons from actual recovery actions, measuring and analysing current and past efforts to find the most important issues (major delays, repeated minor problems) at enterprise rather than system level and deciding where resources are best spent; short-term fixes address low-level causes such as an unpatched system, and long-term improvements feed commonly seen weaknesses into risk management and the security programme, driving new technology, redesigned processes or major changes. Recovery is used to expose weaknesses in technology, processes and people, and personnel document issues as they go, to the extent necessary, so that lessons can be completed accurately soon after recovery.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.