Top management holds the responsibility for evaluating the IRBC: receiving the results of testing, auditing and the Final MBCO determination, judging whether ICT readiness meets the business continuity requirements, and approving the plans or deciding on the treatment of the risks that remain where the objectives are not met, as the clause 5 description of this clause states.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.