Using the standard assumes the organization knows the laws and regulations that apply to it, whether implied, stated or mandatory; that knowledge should be written down and kept current, and new or altered requirements passed on to the staff and parties they touch. The organization should be able to show it can reach current and forthcoming legal and regulatory requirements relevant to what it does and how it complies, covering rules on incident response and emergency management, rules on business continuity where law fixes the reach of the programme or how far or how fast recovery must go, rules on risk where law sets how risk is managed or what it covers, and rules on hazards such as dangerous substances kept on site; an organization active in several places may face the rules of several jurisdictions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.