The responsible entity must adopt a CIRMP that complies with the Rules, and the program (and any variation) must be approved by the entity's board, council or other governing body before it takes effect.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.