The plan must require that audit record anomalies are analysed to determine whether their classification truly indicates an incident and that security events are analysed to learn what an attacker may be aiming at and how on the assets where they were detected; at the Extended Profile automated mechanisms support the analysis of event logs.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.