The security and privacy dependencies among providers, developers and users are described as an ecosystem, borrowing the ecological idea: (a) supplier relationships for products and services; (b) measures that other parties in the ecosystem must provide before a control can be implemented (clause 7); and (c) consequences of a risk scenario that spill beyond one entity (clause 6), for example a provider or developer failing to implement a control and so creating risk for users. Harm can also reach organizations outside a single system, as when vulnerable IoT devices and systems are exploited to attack other organizations or whole countries; such harm has to be handled in a wider ecosystem that includes the parties who could be affected, and the organizations responsible should put controls in place against it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.