Management maintains testing policies, standards, procedures and process controls for internally and externally developed systems so that appropriate personnel find and correct defects including security defects before deployment, testing is sufficient to confirm architectural, functional, security and legal requirements and interoperability with other systems through code-level, system-level and vulnerability testing, test plans start no later than the development and acquisition phase with detail matched to risk, production data used in testing is controlled, the type of testing, results, corrective actions and completion are documented, new controls are tested for conflicts, and manuals and training plans are updated after testing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.