The IoT service provider runs and manages the services an IoT system offers its users, typically connectivity, data collection and management, and the management of IoT assets such as devices. Because a service must fit the user's needs for a given use case or ecosystem, the provider has to understand the users' functional and non-functional requirements, above all for security and privacy, and meet them; to do that it must understand the threat vectors that apply well enough to assess risk and choose effective treatments. The clause 7 controls addressed to the IoT service provider are its controls.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.