The level of specification and verification is illustrated for the three main product types: a standard product needs a requirements specification focused on intended use, installation verification and requirements testing, with supplier assessment scaled to risk; a configured product adds a configuration specification and configuration and functional testing of the applied configuration, with functional specification supplied or leveraged from the supplier; and a custom application adds functional and design specifications, code review, module and integration testing at each level of design. The examples are indicative, most systems combine components of several categories, and the actual approach is scaled by risk, complexity and novelty rather than by category alone; the terminology used is not prescribed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.