Where the organisation uses externally developed elements of its FSMS, stage 1 reviews the FSMS documentation and judges three things about the set of control measures: that it fits this organisation, that it was built to ISO 22000 or the specified FSMS requirements, and that it is being kept current.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.