The risk assessment and the policies must be written down before the entity's first designated service to any customer, and each time either is updated the program as changed must be written down within 14 days. A lead entity's policies must also keep up-to-date records of the reporting group's membership, including changes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.