The cloud service provider determines its eligibility for the STAR program and selects the appropriate assurance level (Level 1 self-assessment, Level 2 third-party certification or attestation, or Level 3 continuous), based on the assurance its customers require.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.