Entities prove the setup, existence and operation of their measures, a requirement that also follows from the Cybersecurity Act implementing NIS2. The BIO's government measures are at tactical level, so an entity first operationalises them, in a risk-focused way that meets good practice and market standards, and part of that operationalisation is being able to detect whether a measure works properly; the whole setup is arranged so that failure of one measure does not immediately expose the entire system. How measures are operationalised is defined through references, which proves setup; existence and operation are proven with or without external parties through self-assessments, audits, penetration tests, red team tests and similar.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.