An independent security audit plan is set and carried out to assure compliance with legal requirements and the security policy, and corrective action is taken.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.