Baseline: periodic security drills or exercises, announced or unannounced, testing security and incident plans, which may be combined with other required drills (a response to a real incident counts). Enhanced: conduct or take part in an annual security drill or exercise (several facilities may share one) and prepare a written post-event report assessing it and documenting corrective actions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.