The organisation works out and writes down the internal and external matters that bear on its purpose and on whether its SOMS can deliver what it is meant to, including its supply chain and subcontractors, and weighs those matters when it sets up, runs and maintains the system and sets priorities. Internally this covers its objectives, strategy and mission, structure, culture, capabilities, resources and existing risk practices; externally the cultural and political setting, legal and regulatory environment, security situation, local communities and the concerns of outside stakeholders, so that those concerns feed into its security operations management criteria.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.