Every client seeking certification produces a practice statement structured per Clause 10 of ISO/IEC 27566-1, its formal claim of conformity and the primary basis for assessment, and publishes it, or an executive summary where law or regulation restricts publication. At minimum it describes the required eligibility outcomes, the methods used, the data sources (authoritative and not), the indicators of effectiveness achieved, privacy and data protection measures, security protections against the relevant attack vectors in outline, usability, inclusivity and acceptability considerations, governance, oversight and audit arrangements, and the standards applied in testing. In addition it declares the relying party needs the item is meant to meet, how data dependencies are managed, how date information is handled correctly, the functional characteristics (suitability, completeness, correctness, appropriateness), the classification accuracy level claimed (Basic, Effective, Highly Effective or Strict) per component or for the whole system, any public specifications it asserts conformity with, and its performance efficiency claims (time, throughput, resource use, capacity).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.