Providers must at appropriate intervals carry out, or arrange, tests that simulate so far as possible the techniques an attacker might use, to identify the risk of compromise; so far as reasonably practicable keep the manner of testing unknown to defenders and suppliers of the tested equipment and prevent them anticipating it; and include tests of staff competence and of unauthorised access to premises holding equipment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.