Third parties are ranked using set criteria, for example how important they are to the function, the impact if they were compromised or disrupted, and how far the organisation can negotiate security terms with them.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.