The plan must require that the incident response plan includes incident containment processes and escalation processes that promptly engage the management level able to authorise the steps needed to contain an incident, and that containment actions feed lessons learned.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.