The incident response plan must include a communications plan specifying the internal and external stakeholders who receive information during response, what is communicated, and that communication to external parties is made only by authorised personnel.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.