For controls to be judged effective in operation, the criteria require as a minimum that they were applied consistently, in line with their design, across the whole period, and that manual controls were carried out by people with suitable competence and authority.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.