Where VoIP or UC services are procured or used for several agencies, agencies must ensure every interested party formally agrees to the risks, controls and residual risks of those services. This responsibility normally sits with the lead agency (Chapters 2 and 4 of this manual, on government information security services and on certification and accreditation, give the context).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.