The organization must supply the customer with the information it needs to show that it meets its own obligations. This may cover whether the organization permits, and takes part in, audits carried out by the customer or by an auditor the customer appoints or approves.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.