Once an information need is identified the organization should inventory its existing measurement and security practices as potential components of the measurement, including measurement associated with risk management, project management, compliance reporting and security policies, before building anything new.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.