The organization shall set up, operate and keep up whatever processes are needed to satisfy sub-clauses 6.1.2 through 6.1.5, and shall keep documented information on those processes to the degree needed to be confident they run as intended. The determination of risks and opportunities, which the 2015 edition placed in this sub-clause, has moved to 6.1.4.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.