If the information security and data protection measures are not fulfilled or not agreed, the body performing the assessment uses other methods; likewise where no agreement on the use of ICT is reached, the assessment objectives are met by other means rather than abandoned.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.