Principle 4: Once a bank has identified its critical operations, the bank should map the internal and external interconnections and interdependencies that are necessary for the delivery of critical operations consistent with its approach to operational resilience.

28. The respective functions should map (ie identify and document) the people, technology, processes, information, facilities, and the interconnections and interdependencies among them as needed to deliver the bank's critical operations, including those dependent upon, but not limited to, third parties or intragroup arrangements.

29. Banks may leverage their recovery and resolution plans, as appropriate, for definitions of critical operations and should consider whether their operational resilience approaches are appropriately harmonised with the organisational mappings of critical operations and critical third-party services contained in their recovery and resolution plans.

30. The approach and level of granularity of mapping should be sufficient for banks to identify vulnerabilities and to support testing of their ability to deliver critical operations through disruption, as described in Principle 3, considering the bank's risk appetite and tolerance for disruption.