Verification confirms that the build is correct and the specified requirements are fulfilled; validation confirms, with objective evidence, that the requirements of a particular intended use are met. The organisation places its system on the spectrum the standard describes: completely verifiable (every component and the whole); partly verifiable and partly validatable; unverifiable but validatable (no component verifiable, all validatable with the whole); unverifiable and partly validatable; or unverifiable and unvalidatable; and plans its assurance accordingly.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.