The report and controls matrix clearly state why each control, design, process or procedure is effective or ineffective. The controls matrix records for each ISM control a brief description of its implementation and effectiveness, the split of responsibility with external providers, the assessment method, and the evidence and its quality.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.