Cybersecurity controls are evaluated to check that they are designed appropriately and operating as intended to mitigate identified risks, for example with performance metrics.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.