A firm's management body must approve its important business services (and important group business services) and impact tolerances, and approve and regularly review the self-assessment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.