The organization must define the boundaries and applicability of the system to set its scope, taking account of the issues from 4.1, the requirements from 4.2 and its own products and services. Every requirement that applies within that scope must be applied, and the scope must name the product and service types, justify any requirement treated as not applicable, and be kept as documented information.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.