The organization should revise the plan to take account of changes in its inputs or risks, including changes to the case the plan was written for, to the production and service provision processes, to the organization's management system, and to statutory or regulatory requirements; and to build in improvements that have been agreed. One or more authorized people should examine changes to the plan for their effect, adequacy and effectiveness. Users, customers, interested parties and external providers, as relevant, should be told of revisions, and what is said to customers and other interested parties should follow the arrangements for externally provided products and services. Documented information affected by a change should be updated as needed. The organization should also decide how, and in what circumstances, it would authorize departing from the plan, covering: who may ask for a departure; how the request is made; what information is supplied and in what form; and who is named with the authority and responsibility to accept or refuse it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.