Per 314.4(d) + (f): continuous monitoring and testing + service provider oversight + program evaluation and adjustment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.