The security controls applied reflect what kind of cloud service it is and how material, how critical and sensitive the information is, and how the data is classified and where it sits.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.