ISO/IEC 27002:2022 control 8.21 applies, with telecommunications guidance: protecting the services offered to network users covers three things: the security of how the services are operated, administered, maintained and provisioned (OAM&P) and configured; the security of the control and signalling data a service relies on (SIP in VoIP, for instance); and the security of users' own data and voice while they are carried by the service (VoIP traffic, for instance).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.