The provider decides which requirements apply to each certified service offering and its supporting infrastructure; where it meets a requirement through a compensatory control instead of as written, it documents the control and why it gives equivalent protection. The SAC certification criteria (CT 14) require the compensatory controls declared to appear in the certificate scope, hold that main clauses are generally applicable and exclusions must not weaken the security level, and give examples by service model.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.