Clauses 4 to 10 of ISO/IEC 27001:2022 carry the requirements; the Annex A controls are not mandatory. Clause 6.1.3 has the organisation define and apply a risk treatment process to determine the controls it needs, compare them with Annex A to confirm nothing necessary was omitted, and record the relevant ones in the statement of applicability, which may include only a subset of Annex A, substitute other controls or add controls, and may omit any Annex A control that does not modify risk cost-effectively. ISO/IEC 20000-1 lists no controls and requires no statement of applicability, so the two do not correlate directly, although its 8.7.3.2 requires the controls addressing security risk to its SMS and to its services to be determined, documented, monitored and reviewed. The organisation needs to keep the difference between a requirement and a control clear and communicated, even where a topic appears in both, to avoid confusion.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.