Describe how responses to assessed risks are developed: matching controls to the protection of assets and to detecting, answering, limiting and recovering from security events; considering the operating environment, its complexity and the scope and nature of operations; using a balanced range of manual and automated, preventive and detective controls; and using risk transfer such as insurance for risks controls do not address.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.