A process produces documentation of the defence in depth strategy of the product for installation, operation and maintenance: the security capabilities and their role, the threats addressed, and user mitigations for known risks including legacy code.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.