For each threat condition the applicant identifies the threat scenarios that could lead to it: the threat source (attacker and attack vector), the vulnerabilities exploited, the operational conditions, the events by which the target is attacked and the threat conditions that result, with the attack path across the security perimeter (the counterpart of a cause in the safety assessment).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.