A Status Justification must be populated for every row not Applicable-Configurable: for Not Applicable it explains why (most commonly a capability absent from the product or an operational environment the product will not be placed in); for Applicable-Does Not Meet it explains what function or feature is absent, which part of the requirement is met and which unmet where partly achievable (the system locks an account after failed logons but not within a time window), notes when no part can be fulfilled, and describes the residual risk after mitigation; for Applicable-Inherently Meets it lists the specific unchangeable product feature that supports the requirement and the type of evidence (test report, vendor documentation or attestation).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.