A process shall be employed to ensure that the people performing security verification and validation are independent of the developers of the item tested, to a degree that increases with the criticality of the test (peer independence for requirements testing, organisational independence for penetration testing).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.