Governance should make sure the policies and practice of information security meet what interested parties require, including laws and regulations, contract terms and commitments made internally. To deal with conformance and compliance, top management can gain assurance that security activities meet internal and external requirements to a satisfactory degree by having independent security audits carried out.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.