Where technically feasible, at least once every 36 calendar months, perform an active vulnerability assessment in a test environment, or in production in a way that minimizes adverse effects, modelling the production baseline, and document the results and any test and production environment differences.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.