At a minimum the owner/operator must store and transmit plans and reports, and audit, testing and assessment results, in line with 49 CFR part 1520 (Sensitive Security Information).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.