Information assets are categorised by sensitivity and potential impact on the critical service (for example public, internal or secret), the categorisation is monitored and enforced, labelling and handling policies and procedures exist, everyone who handles information assets including external contractors is trained in the categories, backups of high-value information are taken and kept, and disposal guidelines are written with adherence monitored and enforced.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.