A process shall be employed to test the effectiveness of the mitigations for the threats in the threat model, including abuse case and misuse case testing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.