The applicant identifies the security assets and protection mechanisms that depend on in-service action and develops the instructions for continued airworthiness that keep them effective after entry into service: physical and operational security procedures, monitoring and auditing of security effectiveness, key and certificate management and the other assumptions the security assurance relied on, handed to operators and revisited when new threats arise.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.