A process shall be employed to document the security requirements of the product, derived from the threat model, the security context, the intended security capability level (the 4-2 SL-C) and any applicable regulation, with traceability to the source.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.