The entity is required to have its program documented, including: an executive policy stating vision, mission, roles, responsibilities and enabling authority; the program's scope, goals, performance objectives and the metrics used to evaluate it; the authorities, laws, regulations and industry codes that apply under section 4.7; a budget and a schedule with milestones; program plans and procedures, each with its expected cost, priority and the resources it needs; records management practices under section 4.9; and management of change.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.