A senior executive, preferably General Manager or equivalent, is designated CISO; the CISO has no direct reporting line to the Head of IT and no business targets; the bank ensures the CISO's technical background and expertise, a reasonable minimum term, an office staffed in proportion to business volume, technology adoption and complexity, and a security budget set against the current and emerging threat landscape.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.