Categorise the system and the information it processes, stores or transmits, document the categorisation with its rationale in the system security plan, and verify that the authorising official or designated representative reviews and approves it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.