The review report under DORA Article 16(2) must be submitted in a searchable electronic format and contain an introduction (context, critical functions, strategy, ICT dependencies, executive summary of risk, threats, control effectiveness and posture, reported area, and major changes and their impact since the last report); the management body approval date where applicable; the reasons for the review with evidence of supervisory instructions or a list of triggering incidents with root cause analysis; the review period and the person responsible; findings with a self-assessed severity analysis; remedying measures with implementation dates, including follow-up of earlier unremedied gaps; and overall conclusions and planned developments.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.