Bringing in a new or revised security plan changes how operations are run, so it has to be done through the organization's management system, which makes sure enough resources are provided, effects on other operations are managed, and the plan is watched and judged for how well it works.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.