The bank has an Information Security Policy covering among other things its objectives, scope, ownership and responsibility, the information security organisational structure, exceptions, compliance review and penalties for non-compliance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.