Authorised users control security attributes, including viewing and changing them, with secure values and defaults. Components: FMT_MSA.1 Management of security attributes (which roles may change which attributes), FMT_MSA.2 Secure security attributes (only secure values accepted), FMT_MSA.3 Static attribute initialisation (restrictive or permissive defaults and who may override them) and FMT_MSA.4 Security attribute value inheritance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.