The organisation must set up, implement and maintain an ISMS with the same thirteen elements as IS.I.OR.200(a): policy, risk assessment (205), treatment (210), internal reporting (215), detection, response and recovery (220), authority-notified immediate measures, response to findings (225), external reporting (230), contracting (235), personnel (240) and record-keeping (245) requirements, compliance monitoring with feedback to the accountable manager or, for design organisations, the head of the design organisation, and confidentiality of information received from others; continuous improvement (260), documented key processes with change control (250, 255), proportionality to the nature and complexity of the activities, and integration with other management systems; the same authority-granted exemption on a documented and approved risk assessment where the organisation's activities, facilities, resources and services pose no information security risk with a potential safety impact, reviewed each oversight cycle and on scope changes. Differences from the I.OR text: feedback goes to the head of the design organisation where applicable, and there is no Part-ATM/ANS derogation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.