When the impact assessment gives an in-scope use case an inherent high-risk rating, two steps follow at once: the accountable official is briefed on why the rating is high, what mitigations are proposed and what risk remains, and oversight of the use case passes to a nominated board or, in a smaller agency, a senior executive. If the agency goes on to deploy it, the accountable official reports the use case to the DTA in the way the Standard for accountability sets out, and the agency sets up a review cycle of no more than twelve months in which the overseeing board or executive hears whether the use case is working as intended and its risks are under control, with the impact assessment and any revisions re-examined. Inherent medium-risk use cases do not trigger these duties, but the agency should weigh whether board or senior executive oversight would help and pick an arrangement that fits its size.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.