Security requirements shall include the scope and capabilities of the product, the security capability level it targets, the expected product security context, and the mitigations for the threats identified, stated so they can be verified.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.