Input: all necessary controls (8.3). Action: compare them with the controls in 27001:2022 Annex A. Trigger: formulating treatment plans makes finding any missing controls necessary. Output: all controls applicable to treatment. The comparison 27001 6.1.3 c) requires is a safety check that no necessary control from any source was missed, not a hunt for Annex A controls absent from the assessment; missing controls found can be sector, custom or Annex A ones and are added following 8.3, never simply because they already operate. It is done risk by risk on the risk assessment, not on the Statement of Applicability.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.