The management system scope is set around the core services and personal information processing, including key assets that affect them, with any exclusions recorded with reasons, consultation and approval, and documented (services, processing, organisation, assets, locations, system lists, documents) so the scope can be confirmed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.