Where a risk is not acceptable the applicant derives security effectiveness requirements, the bottom-up requirements on security measures that bring the risk to an acceptable level (the counterpart of derived safety requirements); they express security effectiveness objectives, statements of the effectiveness to be achieved against a specified security environment, where effectiveness is a measure's ability to curb misuse of the assets by unauthorised parties while preserving their use by authorised ones.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.