Besides geography, the assessment should record the technical deployment environment and its constraints, for instance whether the system is an online service or an application, whether it is a platform, whether it is deployed in the cloud, open source considerations, whether it runs only on particular hardware or only inside particular applications, whether the infrastructure it needs is in place, the security requirements, and the relevant context including knowledge of and past experience with the system.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.