The plan should say: how products and services supplied by customers or by external providers are recognised and kept under control; the methods for checking that they meet the specified requirements; and how any that do not conform will be controlled. Such property can include premises, materials, components, tools, equipment, intellectual property and personal data; ISO/IEC 27002 gives information security guidance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.