Offerings must be assessed by an independent third party, normally a FedRAMP recognized 3PAO listed on the Marketplace that meets the quality, independence and FedRAMP knowledge requirements; where an agency uses its own independent verification and validation organization or another assessor, the agency AO must attest to the assessment organization's independence and the assessor must use FedRAMP templates; under A2LA R311 a 3PAO that provided advisory services on an offering cannot assess the same offering for two years, so a provider that engages a 3PAO as an advisor engages a different one for the independent assessment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.