Guidance: the organization should keep watching the risk management framework and adjusting it so that it responds to changes outside and inside the organization, and by doing so can increase the value the framework delivers.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.