The control system must be able to use protection mechanisms against malicious code and unauthorized software that prevent it, detect it, report it and limit its impact, and to keep those mechanisms updated. RE 1 requires the protection at every point where data enters or leaves; RE 2 requires the protection mechanisms to be managed and reported on centrally.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.