M1 holds the estate. The remaining fourteen modules read from it, so a risk, a control, a vulnerability and a piece of audit evidence all resolve to the same asset. Adopt them in the order your obligations demand.
/modules-data.js, so corrections happen in one file.
That depends on who is asking, and what they will accept as evidence. A short conversation is usually enough to work out the shortest route to a defensible position.