The applicant characterises the security measures, existing and proposed, that mitigate or control each threat condition: features, functions or procedures, on board or off board, technical, operational or management in kind (RA 5890 groups them as technical and procedural), and records what protection each is relied on to give (see also 3.4.2).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.