The evidence-gathering plan shall be based on the risk assessment, designed to lower verification risk to an acceptable level, and shall specify the type and extent of evidence-gathering activities; it should not be communicated to the client or responsible party.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.