For every threat listed in 3GPP TR 33.926 chapter 5.3 the vendor shall document whether the network product mitigates it. Where the product leaves a threat unmitigated or only partly mitigated, the vendor shall state either that the product is not affected by it or that measures in the operational environment mitigate it; where mitigation depends on requirements on the operational environment, those requirements shall be fully described, and otherwise it shall be stated that none exist.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.