The report clearly states every constraint or limitation that affected the assessment and its impact. Where the available evidence does not support an accurate determination, the limitation is documented in the Security Assessment Report and the controls matrix (the no visibility status may apply), so that consumers can make a risk-based authorisation decision knowing what information, evidence or method was missing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.