The assessment covers all applicable environments, software, workstations, network devices, servers and other devices or services inside the assessment boundary; it is the assessor's responsibility to validate the boundary the organisation proposes, and exclusions need strong justification.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.