Where risks are found the facility must report them to senior management, adopt a risk management plan and strategy per the Annex II model (continue trading during measurable mitigation, suspend temporarily while mitigating, or disengage where mitigation is not feasible), consult suppliers, authorities and affected stakeholders on measurable mitigation, build and use leverage, implement and monitor the plan, and suspend or end the relationship for at least three months if there is no significant measurable improvement within six months of adopting the plan; it must keep monitoring risks and reassess after changes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.