The asset owner shall review the security program periodically for its effectiveness and its continued suitability, and act on the results, which is the continual improvement loop of the SP.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.