Security requirements are identified by assessing information security risks systematically, weighing the cost of controls against the harm to the business that security failures would probably cause; the results steer management action, risk management priorities and the choice of controls (ISO/IEC 27005 offers more guidance). The risk assessment should be redone at intervals, no less than once a year, to take account of changes that could alter its outcome.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.