The assessor bases the assessment on the evidence presented and the facts, and makes no inappropriate assumptions. Evidence is graded excellent (first-hand examination or testing of the control in operation), good (review of a variety of sources such as the live configuration), fair (second-hand evidence such as a copy of a configuration) or poor (statements in personnel accounts or specifications, including a policy that repeats the ISM control, or verbal confirmation), and the assessor aims for the best evidence available for each control.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.