Besides what 4.2.2 asks of it, the risk management plan also points to the 14.11 PEMS validation plan.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.