The organization plans, puts in place and controls the processes required to satisfy requirements and to deliver the actions set in clause 6: it sets criteria for those processes, runs them in line with the criteria, and keeps the documented information needed to show with confidence that they were carried out as planned. It controls changes that are planned, reviews what follows from unintended changes and reduces any adverse effects, and controls processes, products or services supplied from outside that are relevant to the system. The specific controls of 8.2 to 8.10 are among these processes. An outside provider stays outside the system's scope even though the function or process it supplies falls inside it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.