A process shall be employed to document the intended security context of the product: the environment it is expected to operate in, the assumptions about that environment, and the external measures it relies on, so that requirements and threat models rest on a stated deployment context.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.