Enough people with the right skills are allocated to run, watch, keep up and retire security controls across their lifecycle; every relevant role description spells out its security duties; and staffing is re-examined at intervals in the light of threat trends, what incidents revealed and how the organisation has changed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.