The organization shall make sure it takes legal and other requirements into account when it sets up, runs and maintains the system, and that it reviews those requirements at defined intervals.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.