The system is installed, released or configured in its target environment, which can differ from where it was developed (a lab system deployed into vehicles, a client-side system deployed to the cloud). The organisation distinguishes, where relevant, the deployed software components from the model the software uses at run time, since the two can be deployed independently. Organisations should review and improve their risk management processes and controls at deployment and update the risk treatment plan where needed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.