Audit or risk management staff review the scope and results of penetration testing to judge whether the testing firm should be rotated on the quality of its work.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.