Components must (a) be able to keep stored information confidential where explicit read authorization is supported for it, and (b) support keeping information in transit confidential as SR 4.1 of 3-3 defines (SL 1). There is no component enhancement: the IIC list notes that the 3-3 enhancements on untrusted networks and zone boundaries have no 4-2 counterpart.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.