The assessor uses ASD's defined terminology and its intent when determining control implementation: effective, ineffective, alternate control, not assessed, not applicable, no visibility and not implemented, as defined in the ISM and its controls matrix, applying qualitative judgement strongly informed by quantitative assessment objects. Every status, including not applicable and not implemented, carries a written justification; not implemented is accompanied by the business decision or technical constraint behind it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.