A process shall be employed to perform penetration testing on the product, based on the threat model and the attack surface, by people with penetration testing expertise, before release and after significant change.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.