CFI 2.0 introduced blue team requirements for iCAST to measure the effectiveness of the institution's detection, response and recovery functions, so the exercise tests the defenders as well as the red team's attack path, with the blue team encouraged to coordinate with the red team.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.