An entity governs many areas, such as finance, quality, IT, health and safety, and information security. Each forms part of the entity's overall governance objectives and should fit the way the entity is disciplined and run, and their scopes sometimes overlap. The objectives and processes in 7.2 and 7.3 can be used for any governed area. An ISMS concentrates on managing information-related risks; it does not deal directly with profitability, with acquiring, using and realising assets, or with how efficient other processes are, though it should support the organization's objectives in those areas.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.