Software the organisation develops for higher priority assets is built with secure software development practices, for example drawn from the NIST SSDF, BSIMM or OWASP.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.