Security roles and responsibilities are defined at every level with clear channels for communicating and escalating risk. Achieved: key roles are identified and reviewed for continued fitness, filled by capable people with the time, authority and resources to act, and overall accountability is clear.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.