At least once a year the facility must review the due diligence system's performance against its goals through a management review reported to senior management, with an improvement plan where warranted; it must take preventive action against foreseeable problems and run a corrective action process (document, contain, find root cause, fix, report internally and to the programme, and verify effectiveness later).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.