The assessor gathers evidence of sufficient quality that suits the system and the control being assessed, ensuring the depth and coverage support an accurate determination, and discusses evidence, coverage and depth expectations with the assessed entity to agree where control testing should be prioritised and analysis deepened.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.