A firm must have sound, effective and comprehensive strategies, processes and systems, proportionate to its activities, to identify its services, set tolerances and identify and address risks to meeting them, and as part of that must identify and document the people, processes, technology, facilities and information needed to deliver each important business service.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.