The entity is required to identify, evaluate and monitor how vulnerable the entity is, along with its people, property, operations, supply chain operations and the environment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.