For every recommendation in the standard that the manufacturer treats as not applicable to the device or does not fulfil, a justification is recorded. The standard suggests threat modelling to support these decisions and offers Table B.1 as a structured way to record them so assessors, supply-chain members, researchers and retailers can judge whether provisions were applied appropriately; typical grounds are use-case resource constraints, absent functionality, or conflicting industry or regulatory obligations. Status in Table B.1: M (mandatory, a shall provision).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.