On operating effectiveness, the criteria must at least require that the controls were applied consistently, in line with their design, over the whole period, and that any manual controls were carried out by people who had suitable competence and authority.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.