AT-C 320 governs SOC 1 engagements over controls at a service organisation relevant to user entity ICFR, requiring written assertion, system description, and (for Type 2) operating effectiveness testing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.