A firm must keep an up-to-date written record of its compliance assessment covering its important business services and tolerances with justifications, its mapping approach, testing plan, test details and assumptions, lessons learned, vulnerabilities with actions and timings, its communications strategy and its methodologies, and must keep each version for at least six years and give it to the FCA on request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.