The organisation tests whether its SOMS plans, processes and procedures are fit and effective through exercises and other means, with stakeholders taking part; exercises built on operational and incident scenarios work through the issues the risk assessment raised and put the risk management procedures under stress, are designed and run to keep disruption low and the exposure of people, assets and information to a minimum, take place at least once a year and whenever the organisation's mission, structure or external environment changes significantly, and are followed by review and action on the lessons.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.