In setting the requirements for products and services it will offer, the organization makes sure they are defined, taking in the statutory and regulatory requirements that apply and anything it judges necessary, and that it can back up the claims it makes. Under 9100 it also identifies any special requirements the products and services carry, and identifies operational risks such as new technology, whether it has the ability and capacity to deliver, and tight delivery schedules.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.