Requirements have three origins. First, assessing the carrier's information security risks in the light of its business strategy and objectives: the threats to information assets and their weaknesses, how likely incidents are and what they could cause. Second, the obligations the organization must satisfy under law, statute, regulation and contract, cross-border compliance and the socio-cultural setting included; non-disclosure of communications (5.42) and essential communications (5.43) are given as examples of legal requirements, and integrity of transmissions, availability to authorised people and avoiding harm to other facilities as socio-cultural ones. Third, the principles, objectives and business requirements for processing information that the carrier has worked out for its own operations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.