The B/D understands the provider's incident handling approach and makes sure the steps the provider takes and its response timing meet the B/D's requirements, defines the provider's role in incident response clearly and agrees how supporting evidence such as security log records is collected, stored and shared for investigation. It obtains and reviews the provider's track record and experience in incident response management where available, and references from existing subscribers about the provider's incident response plan.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.