An operational resilience framework is operated. Foundational: it meets relevant regulatory requirements and covers identification and management of Important Business Services, impact tolerances for each reflecting safety and soundness and consumer harm, regular updates for strategy and mix, severe but plausible scenario testing and incident exercises, key supplier and outsource provider risk and mapping of critical resources including third parties. Higher levels add more sophisticated scenarios, resilience in strategic change, continuous review with intervention points, and integration at all levels.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.