Whenever a security or privacy asset passes between the equipment and another entity over a network interface, a secure communication mechanism carries it. Two exceptions exist: where the target environment keeps the transfer away from unauthorised entities by physical or logical means, and where a security asset is necessarily exposed while a connection is being set up or managed and further measures authenticate that connection or trust relation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.