Because it has committed itself to compliance, the organisation maintains procedures for periodically evaluating its compliance with the legal and other requirements it has identified, and keeps records of the results of those evaluations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.