Risk register: no Level 1 requirement. At Levels 2 and 3 the CSP keeps a risk register with specified attributes for each risk, including its priority level and control strategy, beyond ISO/IEC 27001's general requirement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.