Major credit information processors shall conduct annual risk assessments specific to personal credit information, evaluating likelihood and impact of breach scenarios, and report results to senior management with risk treatment plans.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.