The organization should monitor for, detect and analyse threats to its ICT services, tracking security incidents, changes in the supporting technology and applications, changes in budget, and how well suppliers and external services perform.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.