The privacy requirements that apply to the organisation, for example from federal law such as the Privacy Act and Consumer Data Right and state health records laws, are identified, even ad hoc.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.