Top management establishes a security operations policy that fits the organisation's purpose, provides the frame for setting objectives, commits to meeting applicable requirements and to continual improvement, commits to respect for human rights and the rule of law and to the organisation's voluntary commitments, and is available as documented information, communicated within the organisation and available to stakeholders as appropriate.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.