The organization should monitor, detect and analyse the threats and events that could lead to an ICT disruption, so that a developing situation, whether a technical degradation, a cyberattack in progress or a supplier problem, is recognised early enough for the prepared response of 6.3 to begin before the disruption becomes intolerable, feeding the incident management interface of 6.5 and the activation and escalation of 10.2.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.