The institution has an adequate IT risk management structure, an independent unit in a large institution or integrated with information security, business continuity, third-party management and compliance in a smaller one, with internal audit providing independent assurance of its effectiveness but not implementing it, and lines of authority established for enforcing and monitoring controls whatever the structure.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.