An operating program carries out cyber risk management activities in the way the risk management strategy sets out, and it is kept in place over time.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.