The controller assesses annually whether the procedure needs updating and also after material changes to systems or processing or when new technological risks become known; an organisation may keep one procedure for all databases at the same level.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.