An organisation with a website must publish the statement there and link to it from a prominent place on the homepage (the guidance says directly visible or in an obvious drop-down, clearly labelled); one without a website must send a copy within 30 days of a written request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.