The A-security profile, kept for compatibility with the 2007 specification, adds authentication at association establishment: additional session, presentation and ACSE requirements and an MMS authentication value carried in the ACSE authentication field, signed with the peer's private key and time-stamped so that the association is authenticated at the application layer even where TLS is not used end to end.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.