Control testing covers the effectiveness of control design and implementation, takes account of changing threats and of the enforcement of control functions, management monitors risk mitigation activities and controls continuously to ensure identified risks are mitigated, and departments give periodic progress reports so that risk management is not a one-time or annual event.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.