Management is aware of and mitigates the risks of IT operations groups such as data centre and network operations, distributed and desktop computing, change and project management, security, resource management and contingency planning, runs a monitoring and response program that remediates vulnerabilities in time, and controls system changes through testing, authorisation and approval, timing of implementation, post-implementation review and rollback or recovery when changes fail.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.