The organization should implement the risk treatment plans through the initiative's development and change processes, with the risk owners carrying out the controls on the planned timing and the action items of 5.2 tracked to completion, so that the PIA changes the design rather than describing it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.