The organization should assess the risks the supply chain poses to it (4.2.2), including sole sourcing and just-in-time supply, smaller buffer stocks and shorter cycle times (introduction), and the supply and demand disruptions of 4.1.1; on the ISO 22301:2019 basis the assessment identifies the risks of disruption to prioritized activities and their required resources, analyses and evaluates them, and identifies the ones that require treatment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.