Documented information required by the system should be controlled so that it is available and suitable for use where and when needed and adequately protected from loss of confidentiality, improper use or loss of integrity, addressing distribution, access, retrieval and use, storage and preservation, control of changes, and retention and disposition, with external documented information identified and controlled; for whistleblowing records access control is the confidentiality safeguard. Parallels ISO 37301:2021, 7.5.3.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.