The institution identifies the key business and support functions whose failure would create material operational or reputational risk, significant financial loss or harm to Hong Kong's financial stability, the critical services or systems under each with their purpose, and for each the threat category (confidentiality, integrity, availability) and test goal (for example exfiltration, insertion, privilege escalation) in a scoping table.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.