The control system must be able to be configured to the network and security settings the supplier recommends in its guidelines, and provide an interface to view and change the settings currently deployed. RE 1 requires a machine-readable report of the current security settings.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.