Inside the planning and control cycle, as part of plan-do-check-act, the CISO coordinates reporting on information security, which culminates each year in an In Control Statement (ICV), or an instrument comparable to it, spanning the whole of the entity's information security system; it can double as part of the formal accountability procedure.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.