The report describes the work: understanding the system and the commitments and requirements, assessing the risk that controls were not effective, testing whether controls were effective, and any other procedures considered necessary. (AT-C 205 .63, Guide Table 4-5)
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.