To fix what its EMS covers, the organization shall decide where the system's boundaries lie and what it applies to. In doing so it considers the external and internal issues from 4.1, the compliance obligations from 4.2, its physical boundaries, functions and organizational units, the activities it carries out and the products and services it offers, and how far its authority and capacity reach to control and influence those activities, products and services across their life cycle. After the scope is set, the system shall take in every activity, product and service falling within it. The scope shall be kept as documented information and be accessible to interested parties.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.