How the organisation has provisioned its broadband connection(s), its physical network (internal data cabling, data switches, etc.) and its logical network (data routing traffic flows) to ensure it is as resilient and redundant (i.e. having extra or duplicate resources available) as possible and how it is protected from breaches, intrusions and other threats.

How the organisation has designed the mapping out of mission-critical applications, how different applications are connected to each other, how they can be accessed by various devices and users and how they are currently performing in terms of efficiency and availability. The applications can range from discrete / stand-alone, web-enabled or cloud-based.

What policies, tools and procedures the organisation has to enable the recovery or continuation of vital technology infrastructure and systems following a natural or human-induced disaster. It focuses on the IT or technology systems supporting critical organisation functions.

How and what the organisation uses to manage end user devices and associated software applications and systems.