The Licensee judges whether its safeguards (policies, procedures, Information Systems and the rest) are sufficient to handle the threats, looking at threats in every relevant part of its operations, including: training and management of staff; Information Systems, covering network and software design and how information is classified, governed, processed, stored, transmitted and disposed of; and how attacks, intrusions and other system failures are detected, prevented and responded to.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.