Audit reports may be integrated or separate for the systems audited, but when the report is integrated every finding it raises can be traced to whichever of the standards it concerns.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.