On completing the assessment, the assessor provides the assessed entity with a complete report and controls matrix setting out strengths, weaknesses, findings and recommendations; these two artefacts are the minimum deliverables of every IRAP assessment. Recommendations are descriptive, stating the issue, its implications and best-practice insight, and do not design or dictate how the entity must address it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.