Institutions whose inherent risk is medium or high carry out the intelligence-led Cyber Attack Simulation Testing, which tests cyber resilience by simulating real-life attacks by competent adversaries using relevant intelligence, beyond traditional penetration testing (which remains required elsewhere); it is preferably run in production to test people and processes as well as technology, and yields indicators of the ability to detect and respond (C-RAF 1.0 chapter 4; TM-C-1 3.5.1(c); the CFI 2.0 circular set the 2.0 iCAST deadlines by group).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.