The asset owner shall address security in its supply chain: requirements placed on service providers and product suppliers (referencing 2-4 and 4-1), and the assessment of what they deliver.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.