Analyse incidents requiring response (attack method, cause and route, system impact, current and potential business impact), preserving logs and other evidence first and analysing the preserved copies; and keep records from detection to recovery (incident details, actions taken, list of logs collected).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.