The assessor should identify and document the flows of PII through the initiative: what PII is collected, from whom and how, where it is stored, who accesses and uses it, to whom it is transferred including across borders and to processors and suppliers, and when it is retained and deleted, typically as data flow diagrams, so that each processing operation can be analysed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.