Top management should show leadership and commitment to vulnerability handling by: making sure the policy and objectives exist and fit the organization's strategic direction; making sure vulnerability handling is built into the organization's processes; making sure the necessary resources are there; explaining why handling vulnerabilities well matters; making sure the process delivers what it is meant to; directing and supporting people to make it effective; promoting continual improvement; and helping other relevant managers show leadership in their own areas.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.