Before the test a control group of senior people who understand the critical assets and systems in scope and their economic functions, with access to the incident escalation chain, oversees planning and execution and agrees objectives (systems, processes, partners and confidentiality, integrity and availability goals); when an incident is detected it confirms with the testers whether it is the simulation, lets the response team continue containment, and prevents false alarms reaching external parties.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.