Where a network product does not mitigate every threat listed in TR 33.926 chapter 5.3, the evaluation is limited to the test cases that check the mitigations it does implement, subject to further rules in AIS-N2. A network product can be hardware and software together or software alone with defined interfaces and defined requirements on its operating environment. For the scheme, the operation environment is the whole set of hardware and software, with their configuration and parameters, that runs the network product and supplies what it needs from its surroundings, including the requirements the product itself places on that environment so that threats it does not mitigate itself are addressed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.