The CBS shall restrict installation, availability and access rights for operating system components, processes, services, network services, ports, protocols, routes, host access and software to what the CBS's functions strictly need. (from SR 7.7 of IEC 62443-3-3)
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.