For each zone and conduit, the threats that could affect it are identified from past incidents and other sources of threat information; the held IIoT paper's list (unauthorized physical, local, remote and cascaded access, denial of service, malware, supply chain attack, phishing, human error, man in the middle) shows the level expected.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.