The organisation sets security operations objectives for the functions and levels where they matter, consistent with the policy, measurable where practicable, take account of applicable requirements and the risk assessment, and are monitored, communicated and updated as appropriate; it keeps documented information on them and plans what will be done, which resources are needed, who is responsible, when it will be finished and how results will be evaluated.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.