The assessor makes no statements of compliance, conformity, certification or authorisation, since such statements undermine the assessment's role in supporting a risk-based authority-to-operate decision; IRAP assessors do not accredit, certify, endorse or register systems.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.