Management makes two assertions: that its description meets the description criteria, and that the program's controls achieved the cybersecurity objectives when measured against a set of control criteria. DC 200 does not supply the control criteria; management selects any criteria that are suitable (relevant, objective, measurable, complete) and available to users, most often the AICPA Trust Services Criteria covering the security, availability and confidentiality categories. The practitioner (a CPA) then opines on both. Where the practitioner also helped prepare the description as a consulting service, independence rules on non-attest services apply.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.