Top management should make sure roles that matter for vulnerability handling have their responsibilities and authorities allocated and made known, and should give someone the responsibility and authority to ensure the handling process conforms to this document and to report to top management on how it is performing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.