What the BIA process produces rests on how well the organization understands two things: the external setting it works in, suppliers and statutory and regulatory bodies included; and its internal operating setting, including business processes, activities and resources and what a disruption to delivering products and services could do. That understanding lets it fulfil its purpose of serving customers (where the organization is non-commercial, its customer may be the public or a supervising authority).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.