Function point analysis (FPA) is the best methodology to use for estimating the complexity of developing a large business application. FPA is a technique that measures the functionality of a software system based on the user requirements and the business processes that the system supports. FPA assigns a numerical value to each function or feature of the system, based on its type, complexity, and relative size. The total number of function points represents the size and complexity of the system, which can be used to estimate the development effort, cost, and time.
FPA has several advantages over other estimation methods, such as:
It is independent of the technology, programming language, or development methodology used for the system. Therefore, it can be applied consistently across different platforms and environments.
It is based on the user perspective and the business value of the system, rather than the technical details or implementation aspects. Therefore, it can be performed early in the project life cycle, before the design or coding phases.
It is objective and standardized, as it follows a set of rules and guidelines defined by the International Function Point Users Group (IFPUG). Therefore, it can reduce ambiguity and improve accuracy and reliability of the estimates.
It is adaptable and scalable, as it can handle changes in the user requirements or the system scope. Therefore, it can support agile and iterative development approaches.
References:
1: Function Point Analysis - Introduction and Fundamentals
2: Software Engineering | Functional Point (FP) Analysis

Limiting the rate of incoming requests, known as rate limiting, helps prevent API overloading by controlling the number of requests a client can make within a specific timeframe. This measure protects the API from being overwhelmed, ensuring better availability and performance. While dedicated servers, continuous integration/deployment, and stress testing contribute to overall system robustness, rate limiting directly addresses the risk of unavailability due to excessive or malicious traffic.
References:
ISACA CISA Review Manual, 28th Edition, Chapter 4: Information Systems Operations and Business Resilience.

An IT risk assessment is the process of identifying and assessing the threats facing an organization's information systems, networks, and data. An IT risk assessment helps an organization to understand its current risk profile, prioritize its risks, and implement appropriate controls to mitigate them. An IT risk assessment also helps an organization to comply with relevant laws and standards, such as ISO 27001 or CMMC.
One of the key steps in an IT risk assessment is the identification of vulnerabilities. Vulnerabilities are the weaknesses or gaps in an organization's information security that could be exploited by internal or external threats. Vulnerabilities can exist in various aspects of an organization's information security, such as:
Hardware: The physical devices and components that store or process information Software: The applications and programs that run on hardware devices Network: The communication channels and protocols that connect hardware devices Data: The information that is stored or transmitted by hardware devices or software applications People: The users or personnel who access or manage information systems or data Processes: The procedures or workflows that govern how information systems or data are used or maintained By identifying vulnerabilities in each of these aspects, an organization can assess its exposure to potential threats, such as hackers, malware, natural disasters, human errors, or sabotage. By identifying vulnerabilities, an organization can also determine its risk level for each threat scenario, based on the likelihood and impact of a successful attack. By identifying vulnerabilities, an organization can also identify the existing or required controls to prevent or reduce the impact of an attack.
Therefore, an IT risk assessment should include the identification of vulnerabilities as a crucial component.
References:
4: What Is an IT Risk Assessment? (Plus Benefits and Components) | Indeed.com
5: How to Perform a Successful IT Risk Assessment - Hyperproof
6: IT Risk Resources | ISACA

The best recommendation for an organization that does not have a process to identify and correct records that do not get transferred to the receiving system is to implement software to perform automatic reconciliations of data between systems. This will ensure that the data integrity and completeness are maintained and that any errors or discrepancies are detected and resolved in a timely manner. Enabling encryption, decryption, and electronic signing of data files may enhance the data security and authenticity, but not the data accuracy or consistency. Having coders perform manual reconciliation of data between systems may be prone to human errors and inefficiencies. Automating the transfer of data between systems as much as feasible may reduce the chances of data loss or corruption, but not eliminate them completely. References: ISAudit and Assurance Standards, section "Standard 1202: Risk Assessment in Planning"