The plan must require that the incident response plan includes processes for vulnerabilities newly found while responding, documents or mitigates them, and integrates with the vulnerability management plan.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.