Since data can be either a strategic asset or a liability, the governing body should: make sure the organization puts in place a formal way of managing data, with assurance where required (6.4.3); understand how the organization and others use data now and might use it (suppliers, customers, regulators, stakeholders, competitors and anyone who could misuse it); recognise how complex and increasingly important data is, and set governance policies and direction that fit the organization's needs and the scale of change needed; make sure the organization's information needs are met by the technology it has now and will have; and, as a sign of accountability, explain what data the organization uses and how extensively.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.