Governance should make sure information security objectives are complete and joined up: information security is dealt with at the level of the entity, decisions reflect the entity's priorities, and physical and logical security are closely coordinated, though a single set of measures or a single ISMS for the whole entity is not required. Who is responsible and accountable for information security should be settled for every activity of the entity, which may reach past its apparent boundaries to information held or moved by outside parties.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.