The manufacturer's design and construction choices must accord with safety principles in light of the generally acknowledged state of the art. In selecting solutions it must work through a fixed order: first identify hazards and their risks from intended use and foreseeable misuse; second remove or reduce those risks as far as possible through inherently safe design; third, where suitable, add protective measures, alarms included, for risks that cannot be removed; and last, inform users of residual risk left because the protective measures fall short. Residual risk is what is left after the first three steps.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.