The vendor keeps an inventory of every sensitive function and sensitive resource the software provides or uses, at minimum the functions that handle sensitive data and the services, configuration files and other information they need, with where the related data is stored, and follows the available guidance for any third-party software or system that provides them.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.