When a nonconformity occurs the organization has to react to it, decide whether action is needed to remove the cause so it does not recur, implement that action, review whether it worked, update the risks and opportunities from 6.1 where needed and make any necessary change to the records system. It also has to keep documented information of the nonconformity, the action taken and the result. The clause assumes nonconformities are found through monitoring, audit, review or other means rather than requiring a separate identification process.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.