Take account of organisation size and capabilities, applying a risk-based approach where a full multi-disciplinary body is too onerous, focusing on the risks the structure addresses.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.