An assessor must secure all information and electronic devices used in IRAP services, as agreed with the customer and in proportion to the sensitivity and classification of the information (3.5.6(a)(iv)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.