Define and use a risk treatment process that picks treatment options in the light of the assessment results; works out every control the chosen options need, from any source; checks those controls against Annex A of ISO/IEC 27001 so nothing needed is missed; produces a Statement of Applicability listing the needed controls, why each is included, whether each is in place, and why any Annex A control is left out; draws up a risk treatment plan; and gets risk owners to approve the plan and accept the residual risk; the process is kept as documented information. Implementation points (general ISMS practice; the 27003 guidance text is not held): design controls from the risks and use Annex A as a completeness check rather than a starting list; express the plan as owned, resourced and dated actions; let risk owners, not the security team, sign off plan and residual risk.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.