The report clearly sets out the activities conducted in each stage of the assessment (plan and prepare, define the assessment boundary, assess the controls, produce the report). Planning determines, with the client, dates and milestones, access to documents (system security plan and annex, risk, design, incident response, policies, SOPs, test plans, BCP and DRP, requirements, build and DevSecOps documents), systems, tools, people and facilities, the intended methodologies and tests, evidence handling after the assessment, outsourced parties, applicable frameworks, the proper use and marketing of the assessment, and the need to give ASD evidence for quality assurance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.