Documented information that the management system and the standard call for must be controlled so that it can be found and used at the place and time it is needed, and so that it is properly protected against disclosure, misuse or corruption. Where relevant, the organization must deal with how such information is distributed, accessed, retrieved and used; how it is stored and preserved, legibility included; how changes are controlled, version control included; and how long it is kept and how it is disposed of. It must also identify and control documented information from outside sources that it judges necessary for planning and running the system. Access may mean the right only to view, or the right and authority both to view and to change.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.