Organizations shall draw up and keep a security plan covering the whole part of the supply chain set out in their Statement of Application, and may divide the plan into annexes, each describing the security for one segment, including the measures that business partners falling under 4.3 or 4.4 will keep up in line with their declarations; the plan or its annexes shall state how the organization will monitor or periodically review those declarations. In preparing their plans, organizations shall examine and take into account the guidance in Annexes A and B.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.