A target security level (SL-T) is set for each zone and conduit from its risk, using the corporate risk matrix and tolerable risk; the SL-T is what IEC 62443-3-3's capability levels are later matched against.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.