Where agencies buy or use cloud services that several agencies will use, they must make sure every interested party formally agrees the risks, the controls and any residual risks of those services.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.