Because a formal agreement fixes each party's responsibilities when a security incident occurs, the subscriber has agreements in place with the parties involved and makes sure their contents are understandable and do not harm the organisation or expose it to heavy loss; ISO/IEC 19086-1 and 19086-4 may guide their preparation and the items of Annex F and Table G.1 should be included.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.