The organization identifies the system under consideration: the collection of IACS assets needed for a complete automation solution, its perimeter, and every access point to it, with the boundaries to other systems documented. The SUC may be drawn wider or narrower (the held IIoT paper includes cloud-based functions to keep its use cases comparable), but it sets the scope of everything that follows.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.