The organisation works out and provides what the SOMS needs to be set up, run, maintained and improved, looking at the internal resources, capabilities and limits it has or could add and at what must come from outside. It exists as a legal entity, or as a defined part of one, and has a management structure that is clearly set out and shows who controls and who answers at every level including subsidiaries in scope, and it documents that structure with the duties, responsibilities and authorities of management, the relationship between the entity and any parent or associated bodies, and its financial standing and insurance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.