Per RMAP: chain of custody + reporting. Requirements include (a) chain of custody documentation + (b) supplier documentation + (c) annual reporting + (d) maintain records.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.