Set up a framework, linked to the formal Emergency Response Plan, that records for each important system the legal, contractual and regulatory obligations that apply and what is being done to satisfy them, and that keeps policies and procedures in line with privacy law, intellectual property rights, rules on handling cryptographic products and requirements for retaining data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.