The report clearly defines the assessment boundary: the system versions and environments assessed (production, pre-production, test, development), the classification of the data, the components and the people, processes, technologies and facilities the system depends on, the corporate network where secure administration makes it relevant (including privileged end-user devices, since jump servers do not protect them), previous assessments, assets, applications, networks, data and facilities, the parties delivering the system with the shared responsibility model and control inheritance, and the controls identified from the SSP annex, CCM and system diagrams. The authorisation boundary may equal or be smaller than the assessment boundary but never larger.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.