Management owns the duty of keeping the institution compliant with the laws and regulations that bear on cybersecurity.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.