The family names the access control security function policies (SFPs) and fixes the scope of each: the subjects, the objects and the operations between them that the policy covers. Components: FDP_ACC.1 Subset access control (a listed subset of subjects, objects and operations) and FDP_ACC.2 Complete access control (every operation between the covered subjects and objects).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.