The domain-based reference model of ISO/IEC 30141 (its Figure 13, redrawn with the user, provider and developer added) gives the structure used for IoT security and privacy: the User Domain (UD, people and digital users), the Physical Entity Domain (PED, the physical things the system senses or acts on), the Sensing and Controlling Domain (SCD, devices and gateways), the Operations and Management Domain (OMD, operation and business support systems), the Resource Access and Interchange Domain (RAID, how outside entities reach the system's capabilities) and the Application and Service Domain (ASD, the providers' applications and services). Risk sources are located by domain (6.2) and every control is marked with one or more domains (clause 7).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.