With requirements, risks and treatment decisions settled, the organization should choose and implement controls that bring risk down to an acceptable level. Telecommunications organizations are advised to pick controls from this document, which supplements ISO/IEC 27002 with telecommunications guidance and controls of its own, and may also design new controls for particular needs. What is selected depends on the organization's risk acceptance criteria, its treatment options and its approach to managing risk, and selection should respect every applicable national and international law and regulation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.