The equipment is free of publicly known exploitable vulnerabilities that would affect its security assets or privacy assets, apart from those that the equipment's particular conditions make unexploitable, those reduced by mitigation to a residual risk the manufacturer accepts, and those accepted outright on a documented risk basis.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.