Objectives of the system or process being assessed are defined and, where practicable, documented, to make risk identification and understanding of implications easier. Objectives should as far as practicable be specific to the subject, measurable in descriptive or numeric terms, realistic given the constraints of context, relevant to the organisation's wider goals and tied to a stated time frame.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.