Security roles and responsibilities of all employees and external parties dealing with information assets are defined clearly, and those of service customers are defined through the service level agreement or similar.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.