The auditor examines the information security objectives set for the relevant levels and functions: consistency with the policy, measurability where practicable, account taken of applicable requirements and of risk assessment and treatment results, communication, updating, documented information retained, and the plans to achieve them stating what will be done, the resources, who is responsible, when they will be completed and how results are evaluated.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.