The methodology in Clause 3 should be followed once a change comes to light; it is a structured set of actions that gets every risk identified and brought down as far as reasonable practicability allows before the change goes live. Not every action is needed for a simple, low-risk change. The operator shall examine what the change affects and should size the process to that agreed impact: the level of scrutiny and the detail at each action is proportionate to the risk the change introduces, a high-risk change needs more careful planning and analysis than a routine one, the process can stop after the risk assessment when the change is judged low enough in risk, and for complex changes sub-actions, extra validation or other processes can be added.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.