The requirements specific to production are set here (text not held). Part 1 calls for the produced files to be documented and for privilege logs of what was withheld, so that it can be shown exactly what was produced and what was held back. Read with the cross-cutting aspects of 6.1.2 and the requirement pattern of 6.2.4, an auditor would also expect production to be planned, carried out by people informed of the agreed forms and of the governing requirements, quality-checked before release, transparent to the receiving party, and adapted when forms or scope change.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.