SIG risk domain K, Operational Resilience. The third party has a resilience strategy and business continuity program (governance, business impact analysis, risk assessment, recovery plans, testing and training, monitoring and reporting) and disaster recovery for the systems in scope, addressing technology, personnel, data, processes and facilities, redundancy and loss of workforce or workspace, so the service continues within acceptable impact tolerances. The 2026 release deepens this domain and maps it to the Operational Resilience Framework, with questions on mapping critical downstream dependencies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.