Where its Risk Assessment shows this to be appropriate, the Licensee makes changes to the Information System only in line with its Information Security Program.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.