Based on the 205 assessment and the 210 treatment, the organisation must implement detection measures for incidents and vulnerabilities that indicate an unacceptable risk with a potential safety impact may be materialising, able to identify deviations from predetermined functional performance baselines and trigger warnings that activate response; response measures that initiate the reaction to those warnings with predefined resources and courses of action, contain the spread of an attack before the threat scenario fully materialises, and control the failure mode of the affected elements; and recovery measures, including emergency measures where needed, that remove the causing condition or constrain it to a tolerable level and bring the affected elements to a safe state within a recovery time the organisation has defined in advance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.