Penetration tests are conducted periodically. The guide expects an annual schedule of tests on the relevant assets, with reports and action plans.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.