The organisation has an incident management plan that is reviewed and updated, the plan's roles and responsibilities appear in job descriptions, and staff are assigned to those roles.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.