ISO/IEC 27002:2022 control 8.32 applies, with telecommunications guidance: consider having procedures and keeping records whenever facilities are installed, moved or taken out; put changes to the infrastructure, both physical and logical, through a change management process that, where relevant, obtains the sign-off of a named risk owner; and have what the change process produces, risk assessments included, audited for security at regular intervals.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.