The report and controls matrix set out the evidence gathered to support both the implementation and the ongoing maintenance of each control, with the quality of that evidence taken into account in the outcome.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.