After an incident, root cause analysis covers organisational process issues as well as technical weaknesses, with all relevant data available. A documented review process captures lessons on reporting, roles, governance and skills as well as technology, uses them to improve security and update and retest plans, prioritises and completes the most important improvements quickly, and restricts sensitive findings to those with a need to know.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.