Risks identified by the operational risk function, by audit, by continuity management and by recovery or resolution planning are fed, as relevant, into severe but plausible scenarios that affect core business lines and critical operations, and the scenarios are built so that they test the tolerance for disruption.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.