Criteria for declaring a cybersecurity incident, and its likely severity, are established at least in an ad hoc way, for example with a high, medium and low scale.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.