Clause 6.1 opens the programme requirements. The subject is the programme itself: the set of rules, criteria and methods that produce a statement. The introduction says a programme can be a simple internal process or an extensive set of rules, so the requirement scales with the statement. What a programme must contain is set by the clauses that follow.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.