The organization should have an IRBC policy that is developed, approved, regularly reviewed and updated so that it stays aligned with the organization's overall objectives and its business continuity policy.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.