The department keeps implemented controls current and adds controls when needed, triggered by changes in missions or objectives, in a business activity (such as collecting more sensitive information), in business needs for security (legislative or policy change), in the threat assessment (more capable threat agents) or by performance monitoring showing a control is ineffective. Using the current profiles, threat reports and monitoring and authorization results, it may redefine controls and reissue profiles and threat reports, deploy new controls, or extend monitoring.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.