The assessment follows the methodologies and approaches of the IRAP Common Assessment Framework, building on them where needed. Its vocabulary follows NIST SP 800-53A Rev 5: assessment objects (specifications, mechanisms, activities, personnel) and assessment methods (examine, interview, test), with the assessor assessing the system holistically and tying findings to the ISM principles.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.