A Licensee with a board of directors has that board, or a suitable board committee, require executive management or its delegates to build, put in place and keep up the Licensee's Information Security Program.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.