Put systems in place that keep the company in compliance with the law that applies to it. ICMM notes that members already comply; the expectation is that they can show stakeholders robust systems assuring it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.