The plan must require that the incident response plan categorises incidents as part of declaration to drive the appropriate response, with consistent criteria informed by the business objective impact classification matrix, classification by the ability to disrupt essential functions, an incident type, a severity ranking and a sensitivity level.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.