The report should identify the risk sources considered: the parties and circumstances from which threats to the PII can arise, internal and external, deliberate and accidental.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.