The applicant summarises for the certification authority how the PSecAC was fulfilled: the risk assessments and their results, the security measures developed and verified, the residual risks and any gaps in analysis, and the guidance passed to operators and integrators.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.