The formal IT change management process requires cybersecurity risk to be evaluated when changes are analysed, approved, tested and reported.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.