Have an unaffiliated third party review the R4 evaluation and the R5 security plans, concurrently with or after their completion.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.