An inventory is kept of the people, information, technology (hardware, software and external information systems) and facilities on which the critical service directly depends; each asset description records its protection and sustainment requirements, its owner and custodian, its physical location inside or outside the organisation, and the organisational communications and data flows it takes part in.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.