Responsibility for the cybersecurity activities within a project shall be given to named people and made known, as RQ-05-03 describes; it may be handed to someone else so long as this is communicated and the related information is passed on.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.