The IoT user is whoever finally uses the IoT service: a human user (a person, or an organization, as in industrial IoT) or a digital user (an automated service acting for a human). The user sets, or at least shapes, what the system must do and how well; the user's core interest is using the system or service without taking on unacceptable security or privacy risk, and the security and privacy level a system must deliver is driven mostly by the users' expectations and risk judgements, even though users often do not understand what the technologies imply for security. Every use case therefore needs a thorough understanding of its users, and there are controls the user should itself consider and apply: those in clause 7 addressed to the IoT user.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.