To support the customer's evaluation, the supplier should supply a record of its cybersecurity capability, covering evidence of organizational capability (good practice in governance, development, quality, post-development and information security), plus evidence of its continual activities and incident response, and a summary of earlier assessment reports.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.