The incident response plan must describe the structure and organisation of the response capability naming roles, responsibilities and the people assigned, with how to reach them; the plan must be distributed to response personnel and stakeholders, updated for organisational or environmental change with changes communicated, and periodically tested to confirm that people understand the roles, the responsibilities and the sequence of actions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.