When an assessment covers multiple services, each is assessed against the controls applicable to it, and deviations from common controls (such as logging, access control and patching applied centrally) are clearly set out for each service in the report and controls matrix.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.