When a firm signs a further arrangement, or renews one, with a CSP it assessed before, it determines on a risk-based approach whether new due diligence is needed rather than assuming the earlier assessment still holds.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.