For reasonable assurance the practitioner must reach the same understanding, identify and assess (not just identify) the risks of falling short of each requirement, respond to them, and learn about the internal controls relevant to the compliance activity, judging how they are designed and whether they were put into operation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.