A combination of in-house and external assurance, typical where an externally produced process is adopted with requirements changed for local needs; external results may need extra in-house validation to show the modified requirements are met (for example a published validated disk imaging process adapted to solid-state devices is validated in-house if no adequate external evidence covers the change).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.