On written notice (period at least 30 days, after consultation), the responsible entity for a system of national significance must undertake a cyber security exercise testing its ability and preparedness to respond to, and mitigate the impacts of, all or specified types of cyber security incidents, meeting any rules requirements, and, if the notice requires, allow designated officers to observe, give them access, assistance and facilities, let them make records and give them reasonable notice of the start.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.