On the description, the criteria must at least require that it presents the design and implementation of the system, covering: the services provided and the kinds of transactions handled; the procedures, both IT and manual, through which transactions are started, recorded, processed, corrected where needed, and reported; the records and supporting information involved; how the system handles significant events that are not transactions; how reports for user entities are produced; the control objectives and the controls intended to achieve them; the complementary user entity controls the design takes for granted; and the other relevant parts of the control environment, the risk assessment process, the information system (communication included), the control activities and monitoring. For a type 2 report the description must also give the relevant details of any changes the system underwent in the period. It must not leave out or distort anything relevant to the scope, while recognising that it is prepared to meet the shared needs of a wide range of users and cannot cover every aspect that an individual user might care about.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.