The incident response plan covers: how the Licensee handles a Cybersecurity Event internally; what the plan is meant to achieve; clearly defined roles and responsibilities and who has authority to decide what; communications and information sharing, inside and outside the organization; what must be done to fix weaknesses found in Information Systems and the controls around them; recording and reporting of Cybersecurity Events and of the response to them; and reviewing and revising the plan once a Cybersecurity Event has been dealt with.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.