The certification scope must include the whole organisation or a clearly defined sub set with documented network and trust boundaries, and the scope must be reaffirmed at each annual cycle.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.