The organization should keep the latest versions of the following in a secure place from which they can be retrieved: statements of coverage; the finished security assessment; who carried out the assessment and their qualifications; the list of every countermeasure considered; security declarations; the security plan with its annexes; records of training and exercises, showing who attended, what was covered and when; and any further documents that regulation or management require.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.