Article 10(4): operators document and review their risk assessments at least annually, make them available to authorities on request, and must be able to show how the information was checked against the criteria and how the degree of risk was determined.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.