The equipment offers at least one way of updating the software, firmware included, that bears on its security assets or privacy assets. Software may be excluded where functional safety considerations rule out updating it, where it is immutable, or where other measures protect the affected assets for the whole life of the equipment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.