Management identifies the principal commitments it makes to user entities (for example in contracts and published service descriptions) and the requirements the system must meet in order to run (below, commitments and requirements), because the effectiveness of controls is judged against achieving them (Guide 2.191, 4.121).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.