Alternate controls stated in the report and controls matrix effectively meet the intent of the ISM control, and the alternate control outcome is supported by sufficient evidence. A risk accepted without adequate alternate controls is marked not implemented; documentation of an alternate control explains it and its justification, its monitoring procedures, and any caveats on use of the system that result.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.