Communities are made up of separate organizations, or parts of them, with no common structure or management functions, so the organizational structures and management functions that govern the community's information security management need to be set out clearly, with management commitment behind them; the differences between members should be considered, including differing legal or regulatory environments, whether a member already operates an ISMS of its own, and each member's rules on disclosing information and protecting assets.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.