The organisation has a cybersecurity program strategy, in its simplest form a list of objectives with the actions to reach them, even if developed and managed ad hoc.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.