The organisation identifies who must receive threat information inside it (for example the service owner and incident handlers) and outside it (for example emergency management, regulators and sharing organisations).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.