The entity is required to create and put in place a mitigation strategy whose measures limit or contain how far-reaching, severe or damaging the consequences are of incidents that prevention cannot stop.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.