The auditor examines that the risk treatment plan was implemented and that documented information of the results is retained, sampling treatment actions to verify they were completed and that the controls they introduced operate.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.