Management documents and maintains AIO policies, standards and procedures, one set in a small entity or many in a large one, that address scope, responsibilities, accountability, authority and guidance: policies as the guiding principles for designing, building and operating information and technology assets, standards that give more granular rules such as what data may reside in the cloud and with what controls, and procedures that describe specific ways to perform AIO activities such as hardening new systems or performing architecture reviews.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.