Compensating countermeasures may replace or supplement inherent security capabilities to satisfy requirements, provided they meet the intent and rigour of the original requirement, considering the referenced standards and differences from them, and follow 3.1.3: they should protect against the same threats with equal protection, not be controls already required elsewhere and not raise risk.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.