The service auditor builds an understanding of the system the service organisation operates, covering the controls that fall inside the engagement's scope.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.