The body must have procedures that define the controls for identifying, storing, protecting, retrieving, retaining and disposing of records related to fulfilling the standard. It must also have procedures for keeping records for as long as its contracts and the law require. Who may read them follows the confidentiality arrangements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.