The bank has a cyber incident response and recovery management policy and procedures addressing definition, classification and assessment of incidents; roles of staff and outsourced staff; reporting by employees, vendors and customers; a communication strategy; containment and timely recovery; collection and sharing of threat information; post-incident review; and periodic testing of response plans.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.