The institution evaluates and adjusts its information security program in light of the results of the testing and monitoring of 314.4(d), any material changes to its operations or business arrangements, the results of the periodic risk assessments of 314.4(b)(2), and any other circumstances it knows or has reason to know may have a material impact on the program.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.