Put change controls in place for developing systems in house or through outsourcing, for modifying systems and for testing them, including the criteria for accepting new systems, oversight of development whether internal or outsourced, and control of upgrades.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.