The responsible entity must review its incident response plan regularly, take all reasonable steps to keep it up to date, and give the Secretary a copy as soon as practicable after adopting it and after each variation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.