The detection tasks planned under 7.6 are put in place, for instance an intrusion detection system raising an alert or a check that reveals logs have been tampered with. This is the point where readiness hands over to the rest of the model: no investigation can begin until an incident has been detected, and the output of this process starts the initialization class (8.2). The clause text is not held.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.