An ASC formally documents one security activity the organisation wants performed at some stage of an application's life cycle, together with its verification measurement, so the control can be approved, maintained, used, verified and communicated. Each ASC takes its requirements addressed from the context components and repositories, its roles and qualifications from the roles repository, and its when from the life cycle reference model; the data structure of ISO/IEC 27034-5 and 5-1 can be used for interoperable ASCs. The committee develops ASCs through the design and implementation processes: it assigns a development team with the right expertise, tells the team which security requirements to meet and which levels of trust are proposed, resources the team, validates and approves the result and adds it to the library, and provides training. The team understands the requirement and its history, inventories existing solutions inside and outside the organisation, considers the legal, business and technological contexts, picks the solution that best reduces the risk, follows the organisation's ASC guidance, documents the solution as an ASC with a value for every attribute (even if unknown), positions it in the library with its parent links, and treats adapted external ASCs as new versions with the originals kept.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.